4 Steps to Intelligent Risk Taking

Global Leading Voice Intelligent Risk Taking April 2017 1AKTUS

Introducing … myself
• M.Sc. Electrical Power Engineering
• 35 year LEGO Group career …
• IT 3 years
• Supply Chain 13
• New Business Area 2
• Product Development 4
• Finance 3
• Strategic Risk Management 10
• Started own consultancy AKTUS
• “Aktiv Usikkerhed” i.e. “Active Uncertainty”
• Uncertainties are here, and will probably only get “worse”
… you may as well learn to leverage them to your advantage

Taking risks is a prerequisite for development
• Risk Scaling
• Risk Portfolio Consolidation
• Risk Tolerance
• Leveraging the risk tolerance

Taking risks must be balanced
with the pursuit of opportunities
• Most companies use some sort of “heat map”
• Keep it simple – balance insights and accuracy with capability
• Identify and address opportunities as well as risks
Impact
Probability VH H M L VL VL L M H VH
Very High
High
Medium
Low
Very Low
OpportunitiesRisks
TargetPerformance

Knowing your scales enable aligning assessments
Start with the scales of impact
Scale Very Low Low Medium High Very High
Financial < 5 ~ 10 ~ 25 ~ 50 > 100
Reputational Next to no
social media
attention
Local press
attention one
day - perhaps
Limited, and
short lived
social media
activity
Days of local
press attention
Some social
media activity
for days
One day full
press attention
plus local
Social media
“shit storm” for
weeks
Full press
attention for
days
Social media
“shit storm” for
months
Full press
attention for
weeks
Environmental Minor damage,
contained to
local area.
Clean up in
days
Significant
damage within
own area.
Weeks to
clean up
Damage to
area outside
own site.
Days to clean
up
Major damage
to surrounding
area.
Weeks/months
to clean up
Catastrophe
for surrounding
area.
Months/years
to clean up
Safety
Liquidity
People

Also address the scales of likelihood within a defined
timeframe – eventually everything will happen
Scale Very Low Low Medium High Very High
Verbal
Extremely
remote ...
but cannot be
ignored
Not likely to
happen
Somewhat
likely to
happen
Quite likely
to happen
Expected
to happen
Percentage
chance within
the defined
timeframe
< 1% 3% 10% 30% > 50%

Setting Scales
• Define impact scales which …
• Are important to your business
• Reflect your risk taking
• Are balanced vertically, i.e. “high is high” irrespective of scale
• Are simple/precise enough for non-risk managers to deal with
• Provide clear avenue to prioritization
• Define likelihood scales which are …
• Precise and independent of impact scale(s)
• Linked to a defined timeframe, e.g. a year or a Business Plan horizon
When assessing the individual risk/opportunity … start defining the potential impact,
and then the likelihood that it will materialize to that extent within the defined period

Well defined and consistent assessment scales are needed
to manage risks and opportunities systematically
• Risk Scaling
• Ensures a consistent approach to risk assessment
• Risk Tolerance

Risk consolidation approach 1
Using a 1…5 scale on both impact and likelihood
• This is dangerous as extreme losses are not considered … Risk D and E in the
same year may “kill” the company
• The resulting exposure of “61” does not tell us much, if anything at all
• The highly likely small risk (1x5) is as important as the remote disaster (5x1)
Risk Name Impact Likelihood Result
A Currency Loss 2 3 6
B Equipment failure 4 2 8
C Competitor Move 3 4 12
D Disclosed cartel participation 5 2 10
E Customer bankruptcy 4 3 12
F IT System breakdown 4 2 8
G Ransomware attack 1 3 3
H Product Quality Breach 2 1 2
Resulting Exposure 61

Risk consolidation approach 2
Monetizing and consolidate combined expectations
• This is dangerous as the “88” is the average expected (financial) loss in any given
period, not the extreme losses the company may suffer
• Furthermore, it does not “really” address non-financial risks very well
Risk Name Impact Likelihood Result
A Currency Loss 50 10% 5
B Equipment failure 200 3% 6
C Competitor Move 100 30% 30
D Disclosed cartel participation 500 3% 15
E Customer bankruptcy 200 10% 20
F IT System breakdown 300 3% 9
G Ransomware attack 20 10% 2
H Product Quality Breach 100 1% 1
Resulting Exposure 88

Consolidation using Monte Carlo simulation
• Monte Carlo simulation is a mathematical approach
• Named after the city, based on “playing” a large number of scenarios
• The results are provided as charts indicating a distribution,
i.e. showing the likelihood the result will be more or less than any given number

There are multiple software products
which can do this on top of e.g. Excel
• For each risk, you
define the impact
and likelihood
• The combination
is a simple formula
in the tool
• You “run” a number
of “scenarios”
• The example chart
tell you, that if you are not at all worried about a loss up to 3.000, there is a 6,7%
chance you need not worry at all
• On the other hand, if you cannot handle/survive a loss above 16.000 – there is a
1,9% risk may actually hit you
• This allow you to address the overall exposure across a portfolio of risks

Knowing your risk exposure is
pivotal for managing risks intelligently
• Risk Scaling
• Using Monte Carlo simulation provides a nuanced picture
• Risk Tolerance

The ISO 31.000 standard
risk taxonomy
Planned
Future
Risk
Appetite
Risk
Tolerance
Risk
Universe
Appetite … We do not bother to control
Tolerance… We can/choose to live with
Risk… Universe… Outcome range, If we don’t do anything

First part … Define the risk tolerance for individual risks
• Define prioritization
In this “heat map”, we
have 4 priority levels.
One may chose as
few/many as needed
to drive balanced
management
• Define action/handling level based on priority e.g.:
1st priority risks MUST be mitigated to a lower level of priority. 1st priority
opportunities must be actively pursued
2nd priority risks are to be mitigated unless this is prohibitively expensive,
complicated or drives the overall risk exposure up
3rd priority risks are to be mitigated based on prudent cost/benefit analysis
4th priority only to be mitigated if simple actions can essentially eliminate the risk
Impact
Probability VH H M L VL VL L M H VH
Very High
High
Medium
Low
Very Low
OpportunitiesRisks
TargetPerformance
1 1
2 3
4

Second Part … Consolidate the financial impact
of risk portfolio and define your risk tolerance
• This approach only
truly works for the
financial impact of
risks and
opportunities
• You can “cheat”
and use your impact
scale to monetize
the non-financial
risks and opportunities
• Based on this, you can define your overall risk tolerance as e.g.
“Our risk taking must ensure that we are 97% certain to lose less than 16.000”
• The example shows that a 1,9% likelihood of losing 16.000, and hence is within
risk tolerance

A strong risk and opportunity management
approach is a prerequisite for intelligent risk taking
• Risk Scaling
• Risk Tolerance
• Defined by combining tolerance on
individual risks and the tolerance on
the portfolio

Taking deliberate chances
“We make money by taking risks,
and we lose money, when we do
not manage the risks we are taking”
Chief Risk Officer
European Industrial Company
“To dare is to lose your
footing for a while. Not to
dare is to lose yourself”
Søren Kierkegaard
Danish philosopher 1813-1855
“If everything is under control,
you are moving to slow”
Mario Andretti
Racing Driver

Utilize your full risk tolerance
Individual risk and opportunities
• Know and manage your risk portfolio according to your guidelines
• Know and pursue the opportunities you may have
Risk & Opportunity Portfolio
• Know your overall exposure
• If/when possible – take more
chances to utilize the full potential
of your risk tolerance
• Be prepared to change the
“game rules” of your business
… before someone else does

Intelligent risk taking is a competitive
advantage vs those who are less proficient
• Risk Scaling
• Risk Tolerance
• Defined by combining tolerance on
individual risks and the tolerance on
the portfolio
• Strong risk and opportunity management
enables you to be closer to the “edge”
– and gives you a competitive advantage

ISO 31000 Training Courses
 ISO 31000 Introduction
1 Day Course
 ISO 31000 Foundation
2 Days Course
 ISO 31000 Risk Manager
3 Days Course
 ISO 31000 Lead Risk Manager
5 Days Course
Exam and certification fees are included in the training price.
https://pecb.com/iso-31000-training-courses | www.pecb.com/events

?
+45 2030 8699 hl@aktus.dk
https://www.linkedin.com/in/hans-l%C3%A6ss%C3%B8e-2933982/
THANK YOU

4 Steps to Intelligent Risk Taking

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to 4 Steps to Intelligent Risk Taking

Similar to 4 Steps to Intelligent Risk Taking (20)

More from PECB

More from PECB (20)

Recently uploaded

Recently uploaded (20)

4 Steps to Intelligent Risk Taking