This document provides an introduction to risk management for small tourism businesses. It defines risk as the prospect of loss from an unwanted outcome or consequence. Effective risk management practices can help small tourism businesses achieve their goals and objectives when faced with risk events. The document outlines the benefits of risk management, such as reducing the impacts of risks and saving time and money. It also discusses the costs of not managing risks, such as endangering safety, damaging reputation, and jeopardizing finances. Finally, it explains how risk management is particularly important for the tourism industry given its reliance on maintaining customer satisfaction, safety, security and confidence.

1. RISK
MANAGEMENT
FOR
SMALL TOURISM
BUSINESSES
Training Manual

3. Risk Management
for
Small Tourism Businesses
This risk management training manual presents a systematic and
comprehensive approach to reducing the negative impacts from both
internal and external events that may affect small tourism businesses.
Specifically, this risk management training seeks to:
- identify and develop processes to minimise the exposure and
vulnerability of small tourism businesses to risks and hazards
- enhance the capacity of small tourism businesses to undertake
proactive risk and crisis management for timely response and
recovery.
Developed by Scott Cunliffe
Written By Yetta Gurtner and Damian Morgan

4. Conditions of Use
STCRC Copyright Statement and Conditions of Use here
DISCLAIMER
The STCRC endeavours to ensure the accuracy of all information contained herein and
otherwise supplied. Advice or opinions given by STCRC in this publication or during the
course of the relevant training provided by STCRC, represents the best judgement of STCRC
but (and to the extent permitted by law) STCRC accepts no liability for any claims or
damages whether caused by its negligence (or that of any of its agents or consultants) or
otherwise. Advice should be obtained from qualified sources to address particular issues.

5. An Introduction to the
Sustainable Tourism Cooperative Research Centre (STCRC)
The Sustainable Tourism Cooperative Research Centre (STCRC) is established under the
Australian Government’s Cooperative Research Centres Program. STCRC is the world’s
leading scientific institution delivering research to support the sustainability of travel and
tourism - one of the world’s largest and fastest growing industries.
The STCRC is a not-for-profit company owned by its industry, government and university
partners.
STCRC input…

6. Acknowledgements
The authors wish to thank all those who assisted in the production of this publication and
associated workshop material. Many people and agencies have freely given their time to
provide practical advice, support, and offer constructive criticism. If the following list is in
any way incomplete, please be assured that it represents an oversight rather than a lack of
appreciation.
APEC International Centre for Sustainable Tourism - Ian Kean
Centre for Disaster Studies - Dr. Scott Cunliffe, Dr David King
Emergency Management Australia – Mike Tarrant
Queensland Tourist Industry Council - Daniel Gschwind
Sustainable Tourism Cooperative Research Centre – Prof. Leo Jago
Sustainable Tourism Services - Stewart Moore
Tourism Tropical North Queensland – John McIntyre
Straun & Associates - David Bierman
Other Partners
• Emergency Management Australia
• Queensland Tourism Industry Council
• Sustainable Tourism Services
• Centre for Disaster Studies, James Cook University
• Tourism Research Unit, Monash University

7. Risk Management
for Small Tourism Business
One-Day Workshop
Contents Page
Foreword
1
A Brief Overview of the Workshop 2
Workshop Outline 4
Introduction to Risk Management for Tourism 6
Understanding Risk and Risk Management for Tourism 7
The Risk Management Process 16
The Business Context and Risks 20
Collaboration and Communication 21
Step 1. Establish the Business Context 26
Step 2. Identify the Risks 29
Risk Assessment and Treatment 33
Assessing the Risks 34
Step 3. Analyse the Risks 36
Step 4. Evaluate the Risks 40
Implementation 46
Step 5. Treat the Risks 46
The Risk Management Plan 50
Crisis Management 51
Crisis Management Planning 52
Appendix
1. Acronyms 64
2. References 65
3. Glossary 67

8. 4. Authors 78

9. Risk Management for Small Tourism Businesses
Foreword
This training manual provides practical knowledge, understanding and skills for small tourism
businesses to implement effective risk and crisis management.
Tourism represents a highly complex, dynamic and competitive business environment. To
remain profitable, small enterprise must be able to successfully negotiate risks and challenges
on a daily basis. Similarly, businesses need to be equally prepared for any unexpected crisis
that may affect business viability. A logical and systematic approach to risk and crisis
management will reduce the impacts and losses associated with any adverse event.
In the past decade, domestic and international tourism has endured a variety of environmental,
political, and economic, challenges and disasters. While the global tourism industry
demonstrates remarkable resilience, the most significant impacts from these events are
generally experienced at a local or regional level. Affected tourism businesses often struggle
to maintain a profitable level of operation and market confidence. With few small tourism
businesses adequately prepared to manage preventable risks and adversity, sound risk
management guidelines for small businesses and operators within the Australian tourism
sector is considered a practical necessity.
The information presented in this training program is referenced from a range of prominent
risk management publications and documentation including; Australian/New Zealand
Standard for Risk Management (AS/NZS4630:2004), Small Business Standard
(HB221:2004), Queensland Government Risk Training and various manuals produced by
Emergency Management Australia. Practical feedback and guidance was also provided
throughout the development process by a broad-based tourism industry reference group and
risk management professionals.
Risk Management Training for Tourism 8
© COPYRIGHT STCRC

10. Risk Management for Small Tourism Businesses
A Brief Overview of the Workshop
Purpose and Scope
Risk Management for Small Tourism Businesses is a practical risk management training
programme for small Australian businesses (typically employing less than 20 people) engaged
in tourism enterprise. This training package is designed specifically to equip participants with
the necessary knowledge, skills and confidence to coordinate effective risk management
practice appropriate to the business environment.
Overall learning objectives:
The objectives of the workshop and training are:
- to increase awareness and appreciation of the nature of risks and crises relevant to
small tourism businesses;
- to develop understanding and familiarity with the process of systematic risk
management;
- to promote active communication, networks and partnerships, and;
- to enhance the capacity of small tourism business to effectively identify, mitigate and
respond to adverse risk events
Training methods
This manual has been developed to support and be used in conjunction with a one day risk
management training workshop. Additional materials include a resource book and website
material available at:
http://www.
The workshop is designed to blend formal instruction with practical activities, guiding
participants through each step of the risk management process. Participants are encouraged to
take notes and will be expected to apply their learning during discussions and group tasks.
While these discussion sessions are intended to examine circumstances relevant to the small
tourism business environment, participants are under no obligation to discuss matters that
may be commercially sensitive or confidential to any business and its practices.
The outline and schedule for the workshop component is presented in the following pages of
this manual.
Risk Management Training for Tourism 9
© COPYRIGHT STCRC

11. Risk Management for Small Tourism Businesses
Participant Requirements
To fully benefit from this risk management training programme, participants are
expected to read this manual prior to attending the one day workshop.
This preliminary task will require a commitment of two to three hours prior to the workshop.
It is not expected that the information and processes will be fully understood at this stage.
There will be ample opportunities throughout the workshop to discuss questions identified
during this preliminary reading.
Guide to Symbols
 Practical exercise
 Risk Management Documentation (Reproduced in Practical Resource Guide)
Risk Management Training for Tourism 10
© COPYRIGHT STCRC

12. Risk Management for Small Tourism Businesses
Risk Management
for Small Tourism Businesses
Workshop – Outline
SESSION ONE 0830-1000
INTRODUCTION TO RISK MANAGEMENT FOR TOURISM
Understanding Risk and Risk Management for Tourism
Defining Risk
Risk Management Practice for Small Tourism Business
Risk Management within day-to-day business operations
Risk Management for the Tourism Industry
Potential Risk to Tourism and Tourism Enterprise
Activity ONE - Risk Recognition
Activity TWO - Current Risk Arrangements
Risk Management - The Process
The Australian Risk Management Standard AS/NZS 4360
The Risk Management Process
Planning to Manage Risks
Defining Responsibility
Producing a Risk Management Plan
MORNING TEA 1000-1030
SESSION TWO 1030-1200
BUSINESS CONTEXT AND RISKS
Communication and Consultation in Risk Management
Identifying Stakeholders
A Communications Plan
Tourism Communications and Stakeholders
Activity THREE - Key Stakeholders and Contacts
Step1. Establish the Business Context
Understanding the Context
Defining Business Objectives
Critical Environmental Factors
Stakeholder Identification and Analysis
Risk Measurement Criteria
Step 2. Identify the Risks
Understanding Risk
Risk Identification
Elements at Risk
Scoping Vulnerability
Risk Statements
LUNCH TIME 1200-1300
Risk Management Training for Tourism 11
© COPYRIGHT STCRC

13. Risk Management for Small Tourism Businesses
SESSION THREE 1300-1430
RISK ASSESSMENT AND TREATMENT
Assessing the Risks
Conducting a Risk Assessment
Step 3. Risk Analysis
Information Gathering
Review of Current Control Measures
Likelihood of Occurrence
Consequences of Occurrence
Calculating the Level of Risk
Step 4. Evaluate the Risks
The Evaluation Process
Tolerable and Unacceptable Risks
Prioritising for Risk Treatment
Activity FOUR – Developing a Risk Register
Implementation
Step 5. Treat Risks
Risk Treatment Options
Assessing and Developing Treatment Options
Developing a Risk Treatment Schedule/Action Plan
Implementation
The Risk Management Plan
Monitoring and Review
AFTERNOON TEA 1430-1500
SESSION FOUR 1500-1630
CRISIS MANAGEMENT
Crisis Management Planning
Defining Crisis
Understanding Crisis Management
Crisis Management and Tourism
Business Continuity
Resource Identification
The Four “Rs” of Crisis Management – A Practical Approach
Crisis Communications (Containment) and Reporting
Recovery and Marketing
Developing a Crisis Management Plan for Small Tourism Business
Activity FIVE – Proactive Crisis Management Planning
QUESTIONS AND DISCUSSION 1630-1700
END WORKSHOP 1700
Risk Management Training for Tourism 12
© COPYRIGHT STCRC

14. Risk Management for Small Tourism Businesses
SESSION ONE
INTRODUCTION TO
RISK MANAGEMENT FOR TOURISM
Understanding Risk and Risk Management for
Tourism
Defining Risk
Risk Management Practice for Small Tourism Business
Risk Management within day-to-day business operations
Risk Management for the Tourism Industry
Potential Risks to Tourism and Tourism Enterprise
Activity ONE - Risk Recognition
Activity TWO - Current Risk Arrangements
Risk Management - The Process
The Australian Risk Management Standard AS/NZS 4360
The Risk Management Process
Planning to Mange Risks
A Risk Management Policy Statement
Defining Responsibility
Producing a Risk Management Plan
Risk Management Training for Tourism 13
© COPYRIGHT STCRC

15. Risk Management for Small Tourism Businesses
INTRODUCTION TO RISK MANAGEMENT FOR TOURISM
UNDERSTANDING RISK AND RISK MANAGEMENT FOR TOURISM
Most people are familiar with the notion of risk. Individuals and businesses make choices and
decisions relating to risk on a daily basis. The risk may be associated with a planned tour, a
business acquisition or the most advantageous way to arrange a display. The intent is to
achieve the desired aims or objectives without things going wrong. Good decision making in
the face of risk is generally improved where accurate information, understanding, and
expertise is available.
Risk management by small tourism businesses is a practical and systematic approach to
making good decisions about risk. Based on a logical sequence of steps, it is a process of
strategic planning and management that helps to identify, analyse, evaluate and treat potential
risks. In practice, effective risk management should be a collective endeavour that is
understood and exercised by all relevant personnel. To develop and coordinate such a system
of risk management in any business environment first requires an understanding and
familiarity with the concept of risk.
Defining risk
Risk most commonly refers to the prospect of loss. This loss is usually
some form of unwanted outcome or undesirable consequence from a
specific action or occurrence.
Risk is an intangible term generally associated with the dangers and uncertainties of life. In a
business context, risk typically refers to the prospect of loss. More specifically, risk is
associated with circumstances that potentially result in a loss of business viability and/or
profitability.
Like any enterprise, small tourism businesses face a diverse range of risks and uncertainty.
Some of these risks affect multiple tourism businesses, such as: dramatic interest rate
fluctuation; extremes of weather and climate, changes to legislation or variation in tourist
arrival numbers. Other risks like property theft, staff injury, or loss of customers might impact
on a single or limited number of tourism businesses.
Figure 1. The relationship between risk and a risk event
Risk Management Training for Tourism 14
© COPYRIGHT STCRC

16. Risk Management for Small Tourism Businesses
Risk Event
Cause RISK Consequence
Risk is commonly connected with a cause and a consequence. The cause may represent
direct physical exposure, dynamic pressures, unsafe conditions or defective business practice.
Risk refers to the specific hazard or potential danger that has been identified. In this sequence,
consequence relates to any impacts or affects if the risk eventuates. The entire succession, as
illustrated in Figure 1., is known as the risk event. A risk event might refer to a business
activity, a person’s behaviour or communications, an incident, or an environmental
phenomenon.
Risk as a core principle in risk management
With sufficient information regarding both cause and consequences it is considered possible
to measure the risk associated with a particular risk event. In this context, risk is gauged as a
prediction or forecast (based on a likelihood estimate) of a given consequence (this is
elaborated in Session 3). Judging the risk of an event assists in choosing appropriate
behaviours or actions to prevent or minimise potential loss. Effective risk recognition and
analysis constitutes the essence of good risk management decision making.
Risk management practice for small tourism businesses
When faced with risk events, effective risk management practices increase
the likelihood of small tourism businesses reaching commercial goals and
objectives.
Planning risk management
Business planning is the process of developing strategies to achieve business goals and
objectives. Strategic business planning also involves a degree of assessment regarding risks
associated with future events. Such a level of planning typically incorporates flexible and
adaptable strategies to address a range of potential situations or outcomes. Most successful
businesses acknowledge that any time taken to devise effective and comprehensive business
plans eventually pays for itself.
Benefits of risk management
Taking a systematic and planned approach to manage risk provides numerous operational
Risk Management Training for Tourism 15
© COPYRIGHT STCRC

17. Risk Management for Small Tourism Businesses
advantages for any business:
- estimating risk helps the business to understand the causes and consequences of a
particular event;
- well devised risk management plans prevent or reduce the severity and duration of a
risk event . This can save both time and money;
- a clear set of procedures assists in the timely identification and coordination of
resources. This process helps minimise potential loss of life and property;
- prepared and coordinated contingency plans enhance customer relationships ; and,
- prepared communication strategies control the flow of critical information during and
following the risk event. This prevents the release of incorrect or damaging information
to stakeholders or the public.
Effective risk management equates to both common sense and good business practice. It
protects business profitability, promotes operational viability, complies with legal and social
responsibilities, and, provides improved access to insurance. Risk management can also
presents additional opportunities such as improved staff management and enhanced
relationships with customers and associated organisations.
Costs of not managing risk
Any comprehensive risk management process requires an investment of time, money, training
and resources. Even so, risk management must be practiced, in some form, by all businesses.
Routine safety practices, security procedures, contract negotiation and legal compliance all
represent common risk management practices.
Good risk management planning is designed to enhance existing capabilities and find the best
method to minimise the cost of risk to the business. To be effective, risk management should
become thoroughly embedded within the business culture, practices and systems. The
consequences of not being prepared for risk include:
- endangering the health and safety of employees, customers, volunteers and participants;
- damaging the business’s reputation, credibility and status;
- undermining public and consumer confidence in the business;
- jeopardising revenues and the business’s financial position; and,
- damaging a business’s plant, equipment or the environment.
Research and experience consistently demonstrates that the costs of not being prepared for
significant hazards can prove devastating to business enterprise, income, resources and even
human lives.
Risk management for the tourism industry
Even though tourism may comprise a diverse range of products, activities, experiences and
Risk Management Training for Tourism 16
© COPYRIGHT STCRC

18. Risk Management for Small Tourism Businesses
locations, it is essentially a service-based industry. Successful tourism enterprise is premised
on maintaining customer satisfaction, positive image and reputation, and confidence, in
existing levels of safety and security. Unfortunately for individual tourism businesses,
offering a quality, safe and responsible operating environment does not always guarantee
continued custom and profits. Due to the erratic nature of risk perception and association, the
poor service or adverse conditions of other businesses and destinations have the potential to
affect local enterprise. Tourism has consistently proven to be highly sensitive to external
shocks and threats. Table 1 demonstrates the diversity of potential risks to tourism and
individual tourism enterprises.
While the steps required for risk management in the tourism industry are essentially the same
as for any other industry, the highly connected and interdependent structure of tourism
presents the individual business with some unique challenges and risks. To maintain
sustainability and prosperity, small tourism businesses require both an intimate familiarity
with the specific business environment and its linkages to the wider tourism industry and
community.
Risk Management Training for Tourism 17
© COPYRIGHT STCRC

19. Risk Management for Small Tourism Businesses
Table 1. Potential Risks to Tourism and Tourism Enterprise
(Adapted from AS/NZS 4360)
RISK CATEGORY/TYPE EXAMPLES
Diseases Contagion affecting humans, plants and/or
animals
Economic Currency fluctuations, interest rates, share
market
Psychological/Emotional Negative image/perceptions, rumour, bad
Association publicity, association with adversity,
visitor dissatisfaction, unfavourable travel
advisories
Environmental Noise contamination, pollution, loss of
biodiversity, erosion
Financial Contractual risks, misappropriation of
funds, fraud, fines
Human Riots, strikes, sabotage, error, terrorism,
violence, war
Natural hazards Climatic conditions, earthquakes,
bushfires, vermin, volcanic activity,
tsunami
Occupational health and Inadequate safety measures, poor safety
safety management, deficient sanitation, low
water quality
Product liability Design error, substandard quality control,
inadequate testing
Property damage Fire, water damage, earthquakes,
contamination, human error
Professional liability Wrong advice, negligence, design error,
misrepresentation
Public liability Public access, egress and safety
Security Cash arrangements, vandalism, theft,
misappropriation of information, illegal
entry, crime
Technological Innovation, obsolescence, explosions,
accidents and dependability
Risk Management Training for Tourism 18
© COPYRIGHT STCRC

20. Risk Management for Small Tourism Businesses
 Activity ONE - Risk Recognition
Objective:
To recognise the number and variety of risks that may potentially affect small tourism
business operations.
Having developed a familiarity with the generic concept of risk, risk events and the
relationship of risk management to small tourism business, such risks should be understood
within a more practical context.
Risk events can clearly have a wide impact across an entire tourism sector, a geographic
region, or may be confined to a particular business. Regardless of magnitude, to remain viable
a small tourism business must learn to successfully negotiate and manage such risks. Before
considering a more formalised approach to the risk management process, it is important to
identify and appreciate some of the key risks to a small tourism enterprise.
Task:
Given the table of Potential Risks to Tourism and Tourism Enterprise provided (Table 1),
consider some of the common (and less common) types of risks faced by small tourism
businesses. In small groups (3-4) share and discuss what you consider to be some of the main
risks (or risk events) that may affect profitability or viability in your business environment.
Also include risks that are currently managed or controlled.
Group findings will be shared with the other workshop participants to develop a wide-ranging
list of relevant risks.
On the basis of this workshop discussion use the table below to outline five risk events that
pose a significant and/or likely threat to current business operations (try including risks you
did not think of yourself). Identify any existing control or mitigation strategies in the left
column.
Risk event (be as specific as possible) Control/loss mitigation strategy
1.
2.
3.
4.
5.
Notes:
Risk Management Training for Tourism 19
© COPYRIGHT STCRC

21. Risk Management for Small Tourism Businesses
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
Risk Management Training for Tourism 20
© COPYRIGHT STCRC

22. Risk Management for Small Tourism Businesses
 Activity TWO - Current Risk Arrangements
Objective:
To determine the scope of current business risk management practice and develop familiarity
with the idea of actively thinking about, planning for and managing risk.
Every business practices some form of risk management. This can include mandatory
compliance with occupational health and safety legislation, routine security procedures, or
insurance carried in the event of damage to property or personal injury. The types of risks
faced by individual tourism businesses and the methods used to manage them, however, can
vary greatly. The range of significant or influential business factors include:
- The nature of the business;
- Size and scope of business operations;
- The type and number of partnerships with other organisations;
- Level of risk awareness and perceptions among owners, managers and employees;
- Attitude to risk events held by owners, managers and employees;
- Knowledge of suitable options to control risks and minimise loss; and,
- Availability of finance and access to resources.
Your task:
From the list you developed in Activity One, examine your notes on current measures of
control and mitigation for each risk event. Identify and list below alternative approaches or
ways in which such strategies may be improved.
Risk event Current control or loss Suggested improvement or
mitigation strategy alternative strategies
1.
2.
3.
4.
5.
The merits and constraints to such risk control and mitigation strategies will be discussed by
the workshop group.
Risk Management Training for Tourism 21
© COPYRIGHT STCRC

23. Risk Management for Small Tourism Businesses
Notes:
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
Risk Management Training for Tourism 22
© COPYRIGHT STCRC

24. Risk Management for Small Tourism Businesses
RISK MANAGEMENT - THE PROCESS
While there are a variety of international approaches to formal risk management, most employ
similar elements and/or processes. In Australia, the pre-eminent guide is AS/NZS 4360. This
training manual remains consistent with this Australian standard.
The Australian Risk Management Standard AS/NZS 4360
The Australian Risk Management Standard AS/NZS 4360 and associated handbook HB436
were developed in response to a perceived need for practical assistance in applying risk
management in public and private sector organisations. Providing a logical and systematic
guide for managing risks, it has become one of the most popular Standards in publication, and
has since been adopted by the Australian Government, Emergency Management Australia and
a range of large public and multinational companies.
The Risk Management Process
Consistent with AS/NZS 4360, the risk management process can be outlined as a series of
iterative steps, completed for each risk management development cycle. At each progressive
step it is important to communicate, consult, monitor and review decisions made. To assist in
understanding and continuous improvement, the process should also be carefully recorded and
documented throughout. Risk management is a continuous process within business, requiring
regular reviews and updates to reflect changing circumstances.
The five key steps and associated tasks to this process are:
Step One – Establish the context or current situation
Profiles the situation and key variables associated with a business internal and external
operational environment.
Step Two – Identify the risks
Creates an inventory of risk events that may directly or indirectly influence business
profitability and/or viability (when, where, how, why).
Step Three – Analyse the Risks
Gathers information about the risk event and current risk control strategies to determine
likelihood and consequences.
Step Four – Evaluate the Risks
Compares analysed risk events to provide a guide to action.
Step Five – Treat the Risks
Develops cost efficient and effective risk event control measures and risk mitigation
strategies.
Risk Management Training for Tourism 23
© COPYRIGHT STCRC

25. Risk Management for Small Tourism Businesses
Figure 2. The Risk Management Process (Adapted from AS/NZS 4360)
STEP 1.
STEP 5.
ESTABLISH
TREAT
THE
THE RISKS
CONTEXT
COMMUNICATE
CONSULT
DOCUMENT
MONITOR
STEP 4. REVIEW STEP 2.
EVALUATE IDENTIFY
THE THE
RISKS RISKS
STEP 3.
ANALYSE
THE
RISKS
Risk Management Training for Tourism 24
© COPYRIGHT STCRC

26. Risk Management for Small Tourism Businesses
Planning to Manage Risks
Rather than waiting for something to happen, risk management is designed to be proactive -
effective planning and implementation can prevent avoidable damages and loss.
A Risk Management Policy Statement
Formal commitment to a systematic risk management process is often established and
communicated to relevant stakeholders in a Risk Management Policy Statement. Intended
to be incorporated with a business’s general management strategies this document briefly
outlines:
- the intention/rational of the policy;
- scope, issues and resources available;
- details of implementation; and,
- linkages with other business strategies.
Figure 3. illustrates the integration of key elements within a general risk management policy.
Defining Responsibility
Although developing and implementing an effective risk management plan should be a
collaborative and consultative effort, the duty is often assigned to a specific person or risk
management team. Specific functions and responsibilities may be officially documented in a
Risk Management Responsibility Statement. Tasks generally include awareness raising,
preparation, coordination, implementation, management and accountability. Additionally this
role or document outlines risk management responsibilities and functions (including a
monitoring and audit statement)
Producing a Risk Management Plan
The final product of a systematic risk management planning process is the establishment a
Risk Management Plan. This plan will contain (but is not confined to):
- a statement of the business risk management policy
- an outline of risk management responsibilities and functions (including a monitoring
and audit statement)
- a communication plan/strategy
- a description of the business context, objectives, risk environment and criteria
- a risk register of risks identified and assessed
- a treatment plan for major risks
Each component of a basic risk management plan will be identified and elaborated during this
training program. While this manual and workshop only provide the foundation for
developing a systematic risk management process, templates, references and generic content
guides for associated documentation have also been reproduced in the supplementary
Risk Management Training for Tourism 25
© COPYRIGHT STCRC

27. Risk Management for Small Tourism Businesses
Practical Resource Guide.
Risk Management Training for Tourism 26
© COPYRIGHT STCRC

28. Risk Management for Small Tourism Businesses
Figure 3. General Risk Management Policy (adapted from Wilkes and Moore 2003 and HB )
Overall Policy Statement
Overall Policy Statement
Overview and intention of general business risk management policy
Overview and intention of general business risk management policy
Objectives Issues and Scope Resources
Objective/rationale of the policy Range of policy issues/extent of risks that Risk management coordinator/team/roles
statement need to be managed Cost/source of required finance
Relationship to future development plans Level of support and expertise
Link Acceptable Risk
Linkage with business/strategic plan Level of acceptable risk likelihood and
consequences for business
Documentation
Review and Monitoring Level of documentation/format Communicate the Policy
Responsibility for monitoring/ Storage/distribution/accessibility/ Communication of policy statement
audit/review/reporting confidentiality Integration of risk management policy
Schedule review/revision of policy Date/authorship/approval/circulation Education/awareness/motivation
Key performance indicators
Risk Management Training for Tourism 27
© COPYRIGHT STCRC

29. Risk Management for Small Tourism Businesses
SESSION TWO
THE BUSINESS CONTEXT AND RISKS
Communication and Consultation
Communication and Consultation in Risk Management
Identifying Stakeholders
A Communications Plan
Tourism Communications and Stakeholders
Activity THREE – Key Stakeholders and Contacts
Step 1. - Establish the Business Context
Understanding the Context
Defining Business Objectives
Critical Environmental Factors
Stakeholder Identification and Analysis
Risk Measurement Criteria
Step 2. Identify the Risks
Understanding Risk
Risk Identification
Elements at Risk
Scoping Vulnerability
Risk Statements
Risk Management Training for Tourism 28
© COPYRIGHT STCRC

30. Risk Management for Small Tourism Businesses
THE BUSINESS CONTEXT AND RISKS
COMMUNICATION AND CONSULTATION
Communication and Consultation in Risk Management
Communication is the provision and/or exchange of information between
individuals (e.g. annual report, press statement)
Consultation is a process of informed communication or discussion
between individuals prior to making a decision, (e.g., staff meeting,
supplier negotiation, industry convention)
The essence of good risk management is decisions and action. Regardless of the size of the
business or organisation, there are a range of individuals who influence, or are affected by any
decisions on risk management. Familiar tourism stakeholders include employees, customers,
industry partners, destination marketers, suppliers and/or service providers. When
considering risk, stakeholders will often hold various and divergent values, experiences,
knowledge, beliefs, assumptions, needs, concerns and opinions. This necessitates open
communication and consultation throughout the risk management process.
Communication and consultation implies a level of discussion or engagement with
stakeholders, rather than a singular “top down” decision making approach. Active
stakeholder participation assists in a broader identification and understanding of risk, and
provides a valuable resource base of information and expertise. The conscious appreciation
of all potential risks assists a business to develop suitable and effective risk control strategies.
Identifying stakeholders
Stakeholders are those people and organisations who may affect, be
affected by or perceive themselves to be affected by, a decision, activity or
risk
The tourism industry is highly integrated and interdependent. Stakeholders affected by the
risk management plan should be communicated with or consulted about risk related decisions
and actions. The method used to consult and communicate will vary according to the type of
Risk Management Training for Tourism 29
© COPYRIGHT STCRC

31. Risk Management for Small Tourism Businesses
decision, stakeholders affected, and stage or step of the risk management plan.
Communication between management and business employees should include a series of face
to face meetings to devise and review the risk management plan. Customers need to be
advised of any specific risk or danger involving the business. Secondary suppliers or partners
may be simply provided with written information detailing the action to be taken by the
business when faced with a particular risk event. Any risk management plan should also be
subject to professional scrutiny to ensure compliance with legal responsibilities and insurance
requirements.
While tourism remains a competitive business, selected risk partnerships or alliances can be
advantageous in risk management. To maintain business operations or finance recovery
marketing campaigns in adverse situations it is not uncommon for a group of small tourism
businesses to combine available resources. Partnering with peak industry bodies and
emergency management services also provides direct access to extensive practical knowledge
and expertise. Other external stakeholders that can be prominent in risk management include
local government, legal advisors, community/special interest groups and the general public.
In addition to such relationships, media management arrangements (public relations) are
considered crucial in effective tourism risk communication and consultation. The media,
including radio, print, television, internet (and any promotional literature), represents a
significant risk management stakeholder. Businesses should establish an ongoing working
relationship with local and regional media networks. It is also important to identify and
maintain a designated media spokesperson for the business. This facilitates the distribution of
timely, accurate and credible information to media sources.
Table 2 illustrates the number and diversity of stakeholders that may be influential in a
tourism business risk management and communication process. The double-headed arrows
signify that communication should be a two-way process.
A Communications Plan
An efficient communication and consultation process entails the development of a risk
communication plan relevant to internal and external stakeholders. The approach taken can
be informal or documented in great detail; however, it must be able to address risk event
issues and the response process. Additionally, small tourism businesses must be adequately
prepared to counter any perceived risks or indirect negative associations.
A typical communication plan will include the following elements:
1. The purpose or goal for the communication.
2. The specific target audience and designated spokesperson
3. The communication strategy (including timings(
4. Methods to evaluate the effectiveness of the strategy
Risk Management Training for Tourism 30
© COPYRIGHT STCRC

32. Risk Management for Small Tourism Businesses
Figure 4. Tourism Communication and Stakeholders
INTERNAL COMMUNICATIONS
Clients Employees Management
(tourists, visitors, (full-time, part-time, (owners, investors,
residents) casual staff, administration,
volunteers and operators)
families)
TOURISM BUSINESS
Suppliers and Media Financial and
Contractors (mass media, Insurance
(goods and services) promotion and Organisations
marketing)
Local Government Local
and Private Sector Community/Public
and
Source Markets
Industry Emergency Other
Partners/Tourism Services (legislative/
Organisations (Local, State, regulatory authorities,
Commonwealth) government)
EXTERNAL COMMUNICATIONS
Risk Management Training for Tourism 31
© COPYRIGHT STCRC

33. Risk Management for Small Tourism Businesses
 Activity Three - Key Stakeholders and Contacts
Objective:
To identify the key stakeholders and contacts necessary to establish good risk management
practice in your business.
Depending on the size and nature of the business, certain individuals or organisations may be
considered more relevant to shaping the specific risk management process. These key
stakeholders are normally those that are regarded as essential to maintain business operations
and profits – under any conditions.
Task:
Based on current business operations, and the communications diagram provided (Figure 4.),
identify and list at least 3* of the internal and external stakeholders that you would consider
most significant in:
a) identifying the risks and potential solutions at your business (Risk Identification)
b) assisting to treat and minimise risks (Risk Mitigation/Treatment)
c) aiding response and recovery from a significant event (Response and Recovery)
Internal Stakeholder External Stakeholder
(specific individual, position/role (specific individual, position/role
or representative body) or representative body)
Risk Identification
(who can help identify relevant
risks and possible solutions)
Risk Mitigation/Treatment
(who can help prevent or reduce
the risks identified )
Response and Recovery
(who can help your business
respond and recover faster if a risk
event occurs)
*some stakeholders may be relevant in more than one category
Given that such stakeholders will normally form the foundation of your risk and crisis
communication plan, the workshop group will discuss ways to expand existing relationships
and networks to promote or enhance a comprehensive risk consultation process.
Risk Management Training for Tourism 32
© COPYRIGHT STCRC

34. Risk Management for Small Tourism Businesses
Notes:
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
Risk Management Training for Tourism 33
© COPYRIGHT STCRC

35. Risk Management for Small Tourism Businesses
STEP 1. ESTABLISH THE BUSINESS CONTEXT
Understanding the Context
Effective risk management must consider what is at risk. The first logical step in a risk
management process is to define the context or the environment in which the business
operates.
The context is essentially a background description of the business and its activities. It
provides a basic understanding or awareness of business operations. The major elements for
describing the context are the business core activities; business objectives; critical business
factors; stakeholder identification; and the risk measurement criteria.
Core business activities
Businesses are typically engaged in a range of core activities. Examples from the tourism
industry include providing accommodation, planning group tours, or the sale of souvenirs.
Depending on the extent of business operations it may be necessary for risk managers to
define a risk context for each activity.
Defining business objectives
Business objectives specify key business outcomes. As anticipated aims or goals, outcomes
should relate directly to the core business activities. Many businesses will find that these
details may already be outlined in existing documents such as the business plans, budget or
strategic plans.
Critical factors of the business operational environment
A range of factors operating inside and outside the business influence its success, viability
and profitability. Such factors may be arranged under the broad categories of business, social,
economic, legal, technical or environmental. Some factors will be linked to the internal
business environment (e.g., staffing, operating procedures and service quality). While
broader external factors such as political instability, competition or legislative changes are
not directly controlled by the business, their influence must be considered in comprehensive
risk management planning.
Stakeholder identification and analysis
Consistent with the development of an effective business communications strategy
(previously discussed) risk management identifies relevant stakeholder needs, concerns and
opinions. Such a process promotes and facilitates broader acceptance of risk management
decisions.
Risk Management Training for Tourism 34
© COPYRIGHT STCRC

36. Risk Management for Small Tourism Businesses
Risk Measurement Criteria
Businesses should develop a set of standards that establish the acceptable (and unacceptable)
level of risk (these are often expressed as statements). These criteria create a base line for
defining likelihood (how often) and associated consequences that are deemed acceptable for
the specific business.
Likelihood criteria may consider :
- risk frequency (chance and rate of occurrence)
- degree of risk escalation i.e. acceptable level of adverse consequences if appropriate
action isn’t taken or the cumulative effect of multiple events
- manageability e.g. existing capability resources, readiness, skills and knowledge
- uncertain or latent risk
Particular risk consequences or scenarios can be used to outline acceptable/unacceptable
thresholds. Examples include:
- human and social factors e.g. fatalities and serious injuries, loss of income, loss of
livelihoods
- economic factors e.g. damage to facilities or critical infrastructure, business disruption,
loss of staff, loss of markets and business opportunities
- environmental factors e.g. damage to cultural and heritage sites, damage to ecological
sites, pollution
- legal factors e.g. litigation relating to statute, regulatory, insurance and common law
- tourism industry factors, e.g. loss of image and reputation eg. loss of customer
satisfaction, negative publicity/association
Risk measurement criteria can represent a set of minimum acceptable standards or be
expressed as critical performance measures.
For example:
The risk of serious injury or death is not acceptable
Activity will be discontinued in temperatures of 38 degrees Celsius and above.
The tour activity will have no harmful impacts on the National Park
Risk Management Training for Tourism 35
© COPYRIGHT STCRC

37. Risk Management for Small Tourism Businesses
Establish the Context – Sample Template (adapted from Queensland Government: 2005)
Description of activity
(What is the activity I want to risk-manage?)
Objectives
(What outcomes do I expect from this
activity?)
Critical Factors Business
(What are the critical factors related to the
activity?) Political
Social/
Cultural
Economic/
Financial
Legal/
Regulatory
Competitive
Infrastructure/
Technology
Environmental
Other
Stakeholders
(Who are the stakeholders in the activity?) Internal
External
Risk evaluation criteria
(What are the key risk criteria for identifying
whether a risk is acceptable or not?)
Risk Management Training for Tourism 36
© COPYRIGHT STCRC

38. Risk Management for Small Tourism Businesses
STEP 2. IDENTIFY THE RISKS
Understanding Risk Perspectives
The way risk is understood directly influences the decision making process. For many
reasons, people will understand and interpret the same risk in different ways. Common
variations relate to: individual risk perceptions; attitudes regarding voluntary and involuntary
risks; and, a personal appreciation of what is acceptable risk.
Risk Perceptions and Tourism
Most tourism businesses and activities are subject to a range of obvious risks that threaten to
compromise life, property and environment. These are common hazards or behaviours which
may be limited, regulated or controlled to some degree. Yet as an industry dependant on
positive image, reputation and consumer confidence, tourism has proven to be particularly
sensitive to risk perception. Risk perception is the appraisal of a risk situation based on
intuitive judgement, personal experience and acquired information. To remain profitable
and competitive, tourism risk management decisions and actions must account for significant
threats and intangible risks, such as rumour, risk association and misinformation. Mass media
can play a substantial role in either escalating or reducing public risk perceptions.
Voluntary and Involuntary Risks
Although public acknowledgement of risks may seem contrary to the relaxed, carefree culture
associated with travel and tourism, there is a moral and legal obligation for businesses to
inform clients and stakeholders of known risks. Responsible risk management further
endeavours to minimise unnecessary or involuntary exposure to possible danger. Airline
safety messages, adventure tourism standards, and hazard awareness signage each represent a
system of voluntary and informed risk.
Acceptable and Unacceptable Risks
An acceptable risk is one in which an informed decision has been made to accept the
likelihood and consequences of a particular risk. In some cases, benefits or opportunities
presented by a particular risk (e.g., borrowing capital for a new business venture) are judged
to outweigh the potential losses. From a business perspective an unacceptable risk is any
event or latent risk that can have significant adverse impacts, demanding a degree of
management or mitigation.
Risk Identification
Having established the context, relevant business factors and key objectives, the next stage in
the risk management process is to identify and describe the risks. Risk identification has four
main components: source of risk; risk information; risk elements; and vulnerability
assessment.
This process should be as thorough as possible because any risk that is not identified during
this stage can later pose a significant threat to the business.
Risk Management Training for Tourism 37
© COPYRIGHT STCRC

39. Risk Management for Small Tourism Businesses
Source of Risks
A hazard is the origin or source of risk
Every conceivable risk has an identifiable source and cause (a what and why). Significant
risk events can usually be traced back to a specific hazard. To identify risks to a business’s
activities and objectives, it is necessary to examine all situations or conditions where there is
a potential for loss, harm and negative impacts.
Identification of potential risk events
To develop a thorough list of business risks requires detailed knowledge and familiarity with
the business activities being reviewed. This essentially represents a description of what can
happen to the business and how. The method of identifying risks may vary depending on the
nature of activities, types of risks, context and purpose of the risk management process.
Common approaches include:
- past experience (individual, stakeholder, regional, government, industry etc)
- historical records (previous incidents, hazard zoning, newspapers, journals etc)
- direct observation, audit and physical inspection
- scenario planning (hazard mapping, develop and analyse specific scenarios etc)
- brainstorming (interviewing, group and/or stakeholder discussions etc),
- checklists (relevant research, publications, insurance policies etc)
- flowcharts (graphical representations)
- expert analysis (professional consultants, industry specialists, professional organisations
etc)
Depending on the specific nature or type of risk under deliberation it may also be necessary to
investigate certain variables related to the risk event such as:
- spatial distribution (the area that a hazard may impact, extent and scope);
- temporal distribution (warning time, frequency, likelihood, time of
day/week/year/season, duration);
- intensity (how big, fast, powerful); and,
- manageability (what can be done about it/mitigation/associated costs).
Risk Elements
An element at risk is something that is valued within/by the business 38
Risk Management Training for Tourism or
© COPYRIGHT STCRC which is associated with the source of risk.
community This includes
people, property, public perception or the environment

40. Risk Management for Small Tourism Businesses
Perceptions or opinions on the elements at risk in any business and its environment can vary
from stakeholder to stakeholder. In identifying potential risk impacts and implications it is
important to investigate and examine all available perspectives. From a small tourism
business perspective significant elements may include personnel/clientele, critical
infrastructure, services or facilities, and reputation.
Vulnerability Assessment
A vulnerability assessment identifies current measures or controls that have been
implemented to mitigate any risk event and associated impacts. As a scoping exercise it
assists to determine the chance of being affected by a particular hazard, existing capabilities,
and provides an understanding the current capacity to recover from resulting adversity. This
should consider risks that may by endemic to the business and impacts from external events.
Risk Statements
The collective aim of the risk identification process is the generation of credible and realistic
risk statements which describe risk events relative to the business context. A risk statement
reveals the interaction between an identified risk source and the elements at risk.
Example:
Source of Risk Risk Event Elements at Risk
Environment Direct impact of > Category Staff, Clients, Plant,
3 tropical cyclone Destination/Environment
(Natural Hazard Exposure)
Human behaviour Customer slips on stairs of Client (may also impact on
business business insurance and legal
(OH&S)
policies)
Although not all risk variables can be controlled, early identification provides the opportunity
to appreciate and manage any potential impacts.
Risk Management Training for Tourism 39
© COPYRIGHT STCRC

41. Risk Management for Small Tourism Businesses
Risk Identification – Sample Template (adapted from Queensland Government: 2005)
Source of Risk Risk Event/ Statement
(How can a risk arise?) (What can happen - event that may impact on the desired objectives?)
Human behaviour
Health/medical
Psychological/Emotional
Association
Technology and technical
issues
Economic
Occupational health and
safety/Regulations
Legal (Liability)
Product/Professional/Public
Political
Property and equipment
Safety/Security
Environmental/Physical
Financial/market/competitio
n
Natural events
Risk Management Training for Tourism 40
© COPYRIGHT STCRC

42. Risk Management for Small Tourism Businesses
SESSION THREE
RISK ASSESSMENT AND TREATMENT
Assessing the Risks
Conducting a Risk Assessment
Step 3. Analyse the Risks
Information Gathering
Review of Current Control Measures
Likelihood of Occurrence
Consequences of Occurrence
Calculating the Level of Risk
Step 4. Evaluate the Risks
The Evaluation Process
Tolerable and Unacceptable Risks
Prioritising for Risk Treatment
Activity FOUR – Developing a Risk Register
Implementation
Step 5. Treat the Risks
Risk Treatment Options
Assessing and Developing Treatment Options
Developing a Risk Treatment Schedule/ Action Plan
Implementation
The Risk Management Plan
Monitoring and Review
Risk Management Training for Tourism 41
© COPYRIGHT STCRC

43. Risk Management for Small Tourism Businesses
RISK ASSESSMENT AND TREATMENT
ASSESSING THE RISKS
Conducting a Risk Assessment
Risk assessment is the central component of risk management. This endeavour requires that
each identified risk event is analysed and evaluated in relation to likelihood (frequency or
probability) and consequence (the impacts). Reviewing any control measures that may be in
place, this process helps to systematically separate minor acceptable risks from the major
risks that must be managed.
Methods used for risk assessment vary in rigour and sophistication. The most suitable or
appropriate type depends on a variety of factors including the nature of the risk, the
information available, and accessible resources. Regardless of the method adopted, effective
risk assessment relies on sound judgement, common sense and the application of valid and
logical techniques. To assist in common understanding and management accountability the
approach used should be clearly documented throughout.
Risk assessment essentially guides the business decisions on the most appropriate and cost
effective way of dealing with an identified risk. Within a formal risk management process it
is conducted in two stages:
- risk analysis
- risk evaluation
Figure 5. illustrates the process of risk analysis, risk evaluation and subsequent decision
making towards effective risk treatment.
Risk Management Training for Tourism 42
© COPYRIGHT STCRC

44. Risk Management for Small Tourism Businesses
Figure 5. Risk assessment as a guide to treatment decisions
(Adapted from AS/NZS 4360)
RISK ANALYSIS
Establishes likelihood and consequences of a
risk event
RISK EVALUATION
Deliberates calculated level of risk
RISK Communicate TOLERABLE/
NOT Consult ACCEPTABLE
Document
ACCEPTABLE RISK
Monitor
Review
TREAT RISK
Decides most appropriate and cost effective
treatment method
Risk Management Training for Tourism 43
© COPYRIGHT STCRC

45. Risk Management for Small Tourism Businesses
STEP 3. ANALYSE THE RISKS
Effective analysis of each identifiable risk comprises of several elements: information
gathering; review of current control measures; likelihood of occurrence; consequence of
occurrence; and, calculating the level of risk
Information gathering
To make an accurate assessment of either likelihood or consequences requires detailed
information and appreciation of the potential risk event. Relevant data sources can include
published literature from industry associations, insurers, government authorities and the
internet. Additional information may be accessible from company records, manager
experience and appropriate industry expertise. Critically appraised on criteria such as
accuracy, validity, applicability, relevance and currency (is it up to date?), all available
information should be considered.
Review of current control measures
A control measure is an existing process, policy, device, practice or other
action that acts to minimise negative risk or enhance positive opportunities
Having previously identified existing controls and capabilities for each risk event, it is
necessary to review these to evaluate effectiveness. Current control measures may reduce the
overall degree of risk; however, there may still be sufficient risk remaining which needs to be
managed.
For example, a business’s control measures for customer property theft may include the
provision of personal safety deposit boxes and public security cameras. There is still a risk
remaining that the customer may lose items or have unsecured items stolen. If the incidence
remains particularly high, this can have direct implications on corporate responsibility,
customer satisfaction and reputation.
Likelihood of occurrence
Using the best accessible information sources and an appreciation of the current control
measures, likelihood of occurrence represents a judgement of probability and/or frequency of
the specified risk event. Approaches used to determine such likelihood can vary however in a
small business environment it may be based on a simple scale describing the frequency of
occurrence (to or within the business) over a term outlined by the risk management plan (e.g.,
five years).
Risk Management Training for Tourism 44
© COPYRIGHT STCRC

46. Risk Management for Small Tourism Businesses
Example of a likelihood scale:
Likelihood of the risk event occurring to or within the business in the next five years:
Designation Likelihood
Low the risk event is not expected to occur.
Medium the risk event might occur
High the risk event is more than likely (or expected) to occur
Consequences of occurrence
Similar to a likelihood estimate, the potential consequences to the business must also be
calculated. Consequences can take many forms including personal injury, financial loss, legal
action, business disruption and/or physical and environmental damage. When assessing the
consequences of a risk event, all forms of loss should be considered.
Example of a consequence scale:
Consequence of the risk event occurring to or within the business in the next five years
(specifically relating to business profitability and viability):
Designation Consequence
Minor the risk event will have little or no influence on business profitability
and will not threaten business viability
Moderate the risk event will reduce business profitability and/or weaken business
viability
Severe the risk event will eliminate business profitability and/or make the
business non-viable
Calculating the level of risk
Using scales appropriate to the business and risk context, the level of risk reflects the
intersection between the likelihood and the consequence ratings.
Example of matrix diagram to calculate level of risk:
Consequences
Minor Moderate Severe
Likelihood
6 5 4
Low
(minor) (low) (moderate)
5 3 2
Medium
(low) (considerable) (high)
4 2 1
High
(moderate) (high) (extreme)
Risk Management Training for Tourism 45
© COPYRIGHT STCRC

47. Risk Management for Small Tourism Businesses
With the calculated risk level expressed as a either a descriptor or number, such analysis can
assist to determine the importance of further action.
For example:
Level Designation Level of Action Required
1 Extreme Immediate action required
2 High urgent action required
3 Considerable high priority action required
4 Moderate low priority action required
5 Low non urgent action required
6 Minor routine action required
Any documentation that details the method of analysis for each business risk should also
explain (or refer to) the basis and rational for the likelihood and consequence judgements.
Risk Management Training for Tourism 46
© COPYRIGHT STCRC

48. Risk Management for Small Tourism Businesses
Risk Analysis – Sample Template (adapted from Queensland Government: 2005)
Risk Event
(identified risk)
Information source
(relevant data sources regarding the
risk event)
Existing control measures
Likelihood of risk occurring
(low, medium, high)
Justification of Likelihood
(based on what information?)
Consequences of risk event
(minor, moderate, major)
Justification of Consequences
(based on what information?)
Level of Risk
(minor, low, moderate, considerable,
high, extreme)
Risk Management Training for Tourism 47
© COPYRIGHT STCRC

49. Risk Management for Small Tourism Businesses
STEP 4. EVALUATE THE RISKS
Based on the outcomes of risk analysis, risk evaluation assists to make the necessary
decisions about which risks need treatment; and, the treatment priority.
As the final stage of risk assessment, such evaluation considers the calculated risk level
against the risk criteria generated in Step 1. Establish the Context (refer page XX). This
process determines whether the risk is acceptable within the defined business context. Given
that each risk should now be better understood, it may be necessary to review the initial
criteria or thresholds to check their continued relevance.
The Evaluation Process
Even with the best available information, analysis and guiding criteria, risk evaluation
remains a value judgement that requires familiarity with the business context. Significant
factors to consider include the overall importance of the activity to the business, the degree of
active control over the risk, both potential and actual losses associated with the risk, and the
relative opportunities the risk presents. Though it is important to remain as objective as
possible, such decisions should involve stakeholder communication and consultation.
The evaluation process will probably reveal that not all risks indicate clear negative
consequences. Expanding or developing a new niche market may be considered a commercial
risk yet successful treatment options can actually enhance the range of positive opportunities.
Similarly, while a degree of property damage can increase insurance premiums it may also
permit structural improvement and equipment upgrades. Effective evaluation requires
balancing the costs, benefits and opportunities against potential adverse consequences/losses.
Cost Benefits Analysis
In the typical business environment findings of the risk assessment process may be presented
as quantifiable cost/benefits estimates or in similar financial terms. Resource allocation or
treatment is generally not warranted if the cost of implementing control measure outweighs
any expected loss. Alternatively if the calculated risk is less than the potential opportunities
represented by the risk even the activity requires further consideration.
Tolerable and Unacceptable Risks
At its simplest, risk evaluation results in two lists or tables representing the following
information:
- a rationale of risks and associated costs that are considered tolerable to the business,
and,
- risks which require some form of active intervention or treatment.
Each list or table should indicate the calculated risk level for further monitoring and review.
Risk Management Training for Tourism 48
© COPYRIGHT STCRC

50. Risk Management for Small Tourism Businesses
Prioritising for Risk Treatment
As no business has limitless resources, risk evaluation should assign the priority or urgency of
any further risk management action. Such prioritisation is generally derived from contrasting
the level of calculated risk with the business’s key objectives and criteria.
The outcome constitutes a practical guide that ranks the businesses precedence for developing
and implementing risk treatment measures.
Risk Management Training for Tourism 49
© COPYRIGHT STCRC

51. Risk Management for Small Tourism Businesses
Risk Evaluation Form – Sample Template
ACCEPTABLE RISKS: UNACCEPTABLE RISKS:
Risk Event Level of Reason for acceptance
(identified risk) Calculated (specific rationale)
Risk
Risk Management Training for Tourism 50
© COPYRIGHT STCRC

52. Risk Management for Small Tourism Businesses
Risk Event Level of Priority/Action Order
(identified risk) Calculated (rank or list from highest to
Risk lowest)
Risk Management Training for Tourism 51
© COPYRIGHT STCRC

53. Risk Management for Small Tourism Businesses
 Activity FOUR - Developing a Risk Register
Objective:
To develop familiarity with the practice of risk assessment and documenting the risk
management process.
Consistent with a logical and systematic approach to risk management it is important to
clearly document the results of any risk identification, analysis and evaluation processes. The
outcome of these steps are often summarised in a risk management plan using a risk register.
While the format and content can vary, a basic risk register will record:
- a description of each risk identified (source/cause and impacts)
- an outline of existing controls
- likelihood
- consequence
- level of risk
- priority/action order
Task:
In small workgroups (3-4), select three generic risk events prepared in Activity 1. Using the
sample risk register, transfer the details of both the identified risks and common control
measures.
With these details and your groups combined industry experience and knowledge as the only
available information, estimate the likelihood and consequences of these events to calculate
the level of risk for a “typical” small tourism business (use the scales and matrix provided -
page 37). Document these results in the risk register.
Assuming that cost vs. benefits is the only significant risk criteria, evaluate whether such risks
are acceptable, and prioritise. Complete these details in the risk register.
Final group findings will be shared and discussed with other workshop participants.
Risk Management Training for Tourism 52
© COPYRIGHT STCRC

54. Risk Management for Small Tourism Businesses
Notes:
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
________________________________________________________________
Risk Management Training for Tourism 53
© COPYRIGHT STCRC

55. Risk Management for Small Tourism Businesses
Risk Register – Sample Template
Risk Event Existing Control Likelihood Consequence Level of Risk Priority/
(identified risk) (control measures/mitigation strategy) Action Order
Risk Management Training for Tourism 54
© COPYRIGHT STCRC

56. Risk Management for Small Tourism Businesses
IMPLEMENTATION
STEP FIVE: Treat the Risks
The primary purpose of treating risks is to reduce the likelihood and consequences of any risk
event considered unacceptable within the business context. Based on a known operational
environment of restricted resources, finance, latitude and time, it is necessary to choose,
prioritise and implement the most appropriate mix of risk treatments. As the last formal step
in the risk management cycle this involves: identifying and assessing options; developing and
implementing treatment plans; and analysing and evaluating residual risk
In planning to treat any risk, care should be taken to ensure that the risks to others are not
inadvertently increased.
Risk Treatment Options
To address any risk there are a variety of options available:
- avoid the risk
- control/change/reduce the risk
- transfer/share the risk
- accept/tolerate/retain the risk
Risk Avoidance:
An informed decision to discontinue, not proceed with a planned activity, or choosing an
alternative way to achieve the objectives
Risk Control:
The provision of policies, standards, and procedures, to eliminate, avoid or minimise adverse
risks facing the business (reducing the likelihood/consequences of the risk). This may involve
a variety of structural measures and changes, however is predominantly achieved through
practical operational and managerial solutions.
Specific strategies to reduce the likelihood of risk include; quality assurance, training,
supervising, testing, inspection/audit and process controls, and preventative maintenance.
Reducing risk consequences may entail; planning for contingencies, minimising exposure to
sources of risk, putting physical barriers in place and activity relocation.
Risk Management Training for Tourism 55
© COPYRIGHT STCRC

57. Risk Management for Small Tourism Businesses
Risk Transfer/Sharing:
Shifting/sharing the responsibility or burden for loss to another party through legislation,
subcontracting, outsourcing, partnerships, insurance, or other means. While this is a common
business practice it should be premised on a platform of mutual consent and awareness of
responsibility and capacity.
Although many businesses rely heavily on insurance, particular care should be taken in
understanding the scope of any policy and obligations. Insurance rarely covers all types of
loss (eg loss of reputation and/or customer satisfaction) and often involves specific
compliance standards and waivers.
Risk Retention:
Intentionally or unintentionally retaining the responsibility for loss within the business. This
generally occurs when a risk can not be avoided, controlled and/or transferred, or relates to a
risk that has not been clearly identified.
Risks that are retained by any business should be monitored and reviewed to determine how
to cover costs in the event of associated losses. Common practice involves the establishment
of emergency/contingency funds to cover such potential losses.
Assessing and developing treatment options
Selection of the best or most appropriate mix of risk treatment options for any business should
be conducted on the basis of cost/benefits, effectiveness and sustainability. A variety of
legislation and Standards already exist to guide and assist in the development of some specific
strategies, yet each option must be reviewed for suitability. Such decision making requires a
comprehensive understanding and review of the business context, objectives and the root
causes of the risk event (how and why it arises).
Considering the established risk criteria this process requires an informed judgement that
further deliberates issues of:
- equity – fair distribution of risks and benefits
- timing – when/how soon the treatment benefits may be realized
- leverage – will treatment lead to benefits in other areas
- cost – how cost effective (direct/indirect/tangible/intangible)
- administrative efficiency – is it easy to implement within the businesses current
operating structure
- resource requirements
- continuity of effects- continuous/short term /sustainability
- stakeholder acceptability
- socio-economic/environmental impacts
- compatibility with business objectives, legal duty, social/corporate obligations
Risk Management Training for Tourism 56
© COPYRIGHT STCRC

58. Risk Management for Small Tourism Businesses
Treatment options and selected strategies should be realistic and feasible. Ideal proposals
may not be possible and may result in tradeoffs or a combination of the most appropriate
approaches. To rationalize such choices to relevant stakeholders there needs to be a clear
indication that the range of benefits justifies the cost of implementing the treatment.
Residual Risk
Consistent with risks that are considered acceptable or retained by the business, risk treatment
can not eliminate every conceivable risk or consequence. Residual risk refers to the level of
risk remaining once treatment options have been implemented. While it is important to
consistently monitor and review such risk levels many business develop specific contingency
or crisis plans to minimise any associated impacts (elaborated in Session 4).
Developing a Risk Treatment Schedule/Action Plan
A risk treatment plan details how the selected treatment options will be implemented,
maintained and reviewed. While format and design may vary, for each unacceptable risk
event it should clearly communicate:
- the nature of the risk event (source and elements at risk)
- treatment approach/strategy and justification (based on the risk priority, likelihood,
consequences and level)
- performance measures/indicators
- responsibilities, resources and timeframes
Implementation
Implementation and integration of a risk treatment plan relies on commitment and familiarity
with the business operating structure and practices. It is common practice to get signed
managerial approval on any treatment plan before changing or initiating any new strategies.
Where risk is inherent in established or routine behaviours it may also be necessary to
stimulate changes in personnel attitudes and motivation. While stakeholder communication
and consultation throughout the risk management process may have increased general risk
awareness and understanding, treatment strategies still need to appear logical and practical.
The business risk management coordinator or team needs to ensure that all relevant details are
documented within a risk management plan and that identified treatment strategies are
realised, on time and within budget.
Risk Management Training for Tourism 57
© COPYRIGHT STCRC

59. Risk Management for Small Tourism Businesses
Risk Treatment Plan – Sample Template (adapted from Queensland Government 2005)
Risk event/statement
(what can happen)
Source of Risk
(how can the risk arise)
Priority
(priority relative to other risks)
Likelihood
(low, medium ,high)
Consequences
(minor, moderate, major)
Level of Risk
(minor, low, moderate, considerable, high, extreme)
Risk Treatment
(specific strategy or approach to
avoid/control/transfer/retain risk)
Responsibility
(who will implement, monitor, review)
Resources required
(human, physical, financial/budget resources to
implement)
Performance measure
(indicators/audit of efficacy, reliability and
availability)
Timetable
(when treatment approach will be
implemented/reviewed/revised)
Risk Management Training for Tourism 58
© COPYRIGHT STCRC

60. Risk Management for Small Tourism Businesses
THE RISK MANAGEMENT PLAN
In following a formalised risk management process as outlined, it is possible to develop a
logical and practical risk management plan for any small tourism business. The level of
documentation generated will reflect the complexity of the business and associated risk
activities and issues. To facilitate communication, accountability and transparency an
effective risk management plan should at least contain:
- A General Risk Management Policy/Statement
- A Risk Management Responsibility Statement
- A Communications Plan
- A Risk Register
- A Risk Treatment Action Plan/Schedule
Consistently, all documentation must be clearly marked with the date created, author, and
scheduled review date.
Although considered an integral developmental and awareness exercise, good risk
management does not end with the production of a paper based risk management plan.
Effective risk management is a continuous process that should become part of a businesses
culture and practice. It needs to be adequately rationalised and accepted by all key
stakeholders. Experience consistently demonstrates that one of the primary causes of plan
failure (or the non-implementation of a plan) is that the objectives, intent, and details of the
plan are poorly understood.
Monitoring and Review
Regardless of the level of detail or intent, it is unlikely that any initial risk management plan
will be perfect or enduring. It is essential to constantly monitor and evaluate the risks,
environmental context and significant factors. Practical risk management integrates a
schedule to regularly review the nature and scope of identified problems and the associated
level of risk. Reflecting a continuous process or cycle of risk management this further
encourages a review the business context, identifies new risks, reviews existing risks and any
associated problems/constraints, evaluates risk levels, and determines related risk treatment
options.
Practice, experience and actual loss will gradually necessitate changes in any plan and provide
information on alternative approaches to the risk faced by the business. While risk
management demands a degree of flexibility and adaptability, a constant and formalised
approach ensures that the process remains both comprehensive and systematic.
Risk Management Training for Tourism 59
© COPYRIGHT STCRC

61. Risk Management for Small Tourism Businesses
SESSION FOUR
CRISIS MANAGEMENT
Crisis Management Planning
Defining Crisis
Understanding Crisis Management
Crisis Management for Tourism
Business Continuity
Resource Identification
The Four “Rs” of Crisis Management – A Practical Approach
Crisis Communications (Containment) and Reporting
Recovery and Marketing
Developing a Crisis Management Plan for Small Tourism
Business
Activity Five – Proactive Crisis Management Planning
Risk Management Training for Tourism 60
© COPYRIGHT STCRC

62. Risk Management for Small Tourism Businesses
CRISIS MANAGEMENT
CRISIS MANAGEMENT PLANNING
Defining Crisis
A crisis is any situation that has the potential to affect long-term confidence
in an organisation or a product, or which may interfere with its ability to
continue operating normally.
While risk management is essentially about anticipating and minimising risks to the business,
crises occur when an unforeseen or unavoidable event does occur. It is an abnormal threat
that may result from the direct impact of an emergency or disaster or be self-induced due to
poor safety conditions, limited capacity or even bad publicity. Consequences of crisis may be
short, medium or long term and affect individuals, a solitary business, a community, a
regional area and even entire nations. Depending on the scale and visibility of the incident, it
may also precipitate significant stakeholder, public and/or media uncertainty.
Regardless of the source, the initial crisis period is typically rapid onset, high pressure and
demands urgent consideration. In management terms a crisis is often described as a
“turning-point” where good practice and decision-making can influence a positive outcome,
and, where limited attention or poorly conceived reactions generally have negative
consequences.
Understanding crisis management
Crisis management is the overall coordination of an organization's response
to a crisis, in an effective, timely manner, with the goal of avoiding or
minimizing damage to the organization's profitability, reputation, or ability
to operate.
Given the number and variety of risks to tourism enterprise, it is impossible to eliminate every
risk factor. Many external situations such as natural hazards, terrorist threats and civil unrest
are beyond direct business or industry control. Alternatively as a consequence of the risk
assessment and treatment process there may have been residual risks. While effective risk
management strategies may have implemented structural changes to limit physical damage, or
institutional procedures to improve public relations and security, some crises are inevitable.
Crisis management planning assists businesses to be better prepared for uncertainty.
Risk Management Training for Tourism 61
© COPYRIGHT STCRC