Risk management standard_030820


Published on

Basic presentation by IRM

Published in: Business, Economy & Finance
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Risk management standard_030820

  1. 1. A Risk Management Standard
  2. 2. Published by AIRMIC, ALARM, IRM: 2002
  3. 3. IntroductionThis Risk Management Standard is the should be viewed not just in the context ofresult of work by a team drawn from the the activity itself but in relation to themajor risk management organisations in many and varied stakeholders who can bethe UK - The Institute of Risk affected.Management (IRM),The Association ofInsurance and Risk Managers (AIRMIC) There are many ways of achieving theand ALARM The National Forum for objectives of risk management and itRisk Management in the Public Sector. would be impossible to try to set them all out in a single document.Therefore it wasIn addition, the team sought the views and never intended to produce a prescriptiveopinions of a wide range of other standard which would have led to a boxprofessional bodies with interests in risk ticking approach nor to establish amanagement, during an extensive period certifiable process. By meeting the variousof consultation. component parts of this standard, albeit inRisk management is a rapidly developing different ways, organisations will be in adiscipline and there are many and varied position to report that they are inviews and descriptions of what risk compliance.The standard represents bestmanagement involves, how it should be practice against which organisations canconducted and what it is for. Some form measure themselves.of standard is needed to ensure that there is The standard has wherever possible usedan agreed: the terminology for risk set out by the• terminology related to the words used International Organization for• process by which risk management can be Standardization (ISO) in its recent carried out document ISO/IEC Guide 73 Risk Management - Vocabulary - Guidelines for• organisation structure for risk management use in standards.• objective for risk management In view of the rapid developments in thisImportantly, the standard recognises that area the authors would appreciate feedbackrisk has both an upside and a downside. from organisations as they put the standardRisk management is not just something for into use (addresses to be found on thecorporations or public organisations, but back cover of this Guide). It is intendedfor any activity whether short or long that regular modifications will be made toterm.The benefits and opportunities the standard in the light of best practice.A Risk Management Standard © AIRMIC, ALARM, IRM: 2002 1
  4. 4. 1. RiskRisk can be defined as the combination of negative aspects of risk.Therefore thisthe probability of an event and its standard considers risk from bothconsequences (ISO/IEC Guide 73). perspectives.In all types of undertaking, there is the In the safety field, it is generally recognisedpotential for events and consequences that that consequences are only negative andconstitute opportunities for benefit (upside) therefore the management of safety risk isor threats to success (downside). focused on prevention and mitigation of harm.Risk Management is increasingly recognisedas being concerned with both positive and 2. Risk ManagementRisk management is a central part of any It must be integrated into the culture oforganisation’s strategic management. It is the organisation with an effective policythe process whereby organisations and a programme led by the most seniormethodically address the risks attaching to management. It must translate thetheir activities with the goal of achieving strategy into tactical and operationalsustained benefit within each activity and objectives, assigning responsibilityacross the portfolio of all activities. throughout the organisation with eachThe focus of good risk management is the manager and employee responsible for theidentification and treatment of these risks. management of risk as part of their jobIts objective is to add maximum description. It supports accountability,sustainable value to all the activities of the performance measurement and reward,organisation. It marshals the thus promoting operational efficiency atunderstanding of the potential upside and all levels.downside of all those factors which canaffect the organisation. It increases the 2.1 External and Internal Factorsprobability of success, and reduces both The risks facing an organisation and itsthe probability of failure and the operations can result from factors bothuncertainty of achieving the organisation’s external and internal to the organisation.overall objectives.Risk management should be a continuous The diagram overleaf summarises examplesand developing process which runs of key risks in these areas and shows thatthroughout the organisation’s strategy and some specific risks can have both externalthe implementation of that strategy. It and internal drivers and therefore overlapshould address methodically all the risks the two areas.They can be categorisedsurrounding the organisation’s activities past, further into types of risk such as strategic,present and in particular, future. financial, operational, hazard, etc.2 A Risk Management Standard
  5. 5. 2.1 Examples of the Drivers of Key Risks© AIRMIC, ALARM, IRM: 2002 3
  6. 6. 2.2 The Risk Management Process The Organisation’s Strategic Objectives Risk Assessment Risk Analysis Risk Identification Risk Description Risk EstimationModification Risk Evaluation Formal Audit Risk Reporting Threats and Opportunities Decision Risk Treatment Residual Risk Reporting MonitoringRisk management protects and adds value to the organisation and its stakeholders throughsupporting the organisation’s objectives by:• providing a framework for an use/allocation of capital and resources organisation that enables future activity within the organisation to take place in a consistent and • reducing volatility in the non essential controlled manner areas of the business• improving decision making, planning • protecting and enhancing assets and and prioritisation by comprehensive and company image structured understanding of business activity, volatility and project • developing and supporting people and opportunity/threat the organisation’s knowledge base• contributing to more efficient • optimising operational efficiency4 A Risk Management Standard
  7. 7. 3. Risk AssessmentRisk Assessment is defined by the ISO/ analysis and risk evaluation.IEC Guide 73 as the overall process of risk (See appendix) 4. Risk Analysis4.1 Risk Identification • Financial - These concern the effectiveRisk identification sets out to identify an management and control of the finances oforganisation’s exposure to uncertainty.This the organisation and the effects of externalrequires an intimate knowledge of the factors such as availability of credit, foreignorganisation, the market in which it operates, exchange rates, interest rate movement andthe legal, social, political and cultural other market exposures.environment in which it exists, as well as the • Knowledge management - These concerndevelopment of a sound understanding of its the effective management and control of thestrategic and operational objectives, knowledge resources, the production,including factors critical to its success and the protection and communication thereof.threats and opportunities related to theachievement of these objectives. External factors might include the unauthorised use or abuse of intellectualRisk identification should be approached property, area power failures, andin a methodical way to ensure that all competitive technology. Internal factors mightsignificant activities within the organisation be system malfunction or loss of key staff.have been identified and all the risks • Compliance - These concern such issues asflowing from these activities defined.All associated volatility related to these health & safety, environmental, tradeactivities should be identified and descriptions, consumer protection, datacategorised. protection, employment practices and regulatory issues.Business activities and decisions can be Whilst risk identification can be carriedclassified in a range of ways, examples of out by outside consultants, an in-housewhich include: approach with well communicated,• Strategic - These concern the long-term consistent and co-ordinated processes and strategic objectives of the organisation.They tools (see Appendix, page 14) is likely to be can be affected by such areas as capital more effective. In-house ‘ownership’ of the risk management process is essential. availability, sovereign and political risks, legal and regulatory changes, reputation 4.2 Risk Description and changes in the physical environment. The objective of risk description is to• Operational - These concern the day-to- display the identified risks in a structured day issues that the organisation is format, for example, by using a table.The confronted with as it strives to deliver its risk description table overleaf can be used strategic objectives. to facilitate the description and assessment© AIRMIC, ALARM, IRM: 2002 5
  8. 8. of risks.The use of a well designed structure detail. Identification of the risks associatedis necessary to ensure a comprehensive risk with business activities and decision makingidentification, description and assessment may be categorised as strategic, project/process. By considering the consequence and tactical, operational. It is important toprobability of each of the risks set out in the incorporate risk management at thetable, it should be possible to prioritise the conceptual stage of projects as well askey risks that need to be analysed in more throughout the life of a specific project.4.2.1 Table - Risk Description 1. Name of Risk 2. Scope of Risk Qualitative description of the events, their size, type, number and dependencies 3. Nature of Risk Eg. strategic, operational, financial, knowledge or compliance 4. Stakeholders Stakeholders and their expectations 5. Quantification of Risk Significance and Probability 6. Risk Tolerance/ Loss potential and financial impact of risk Appetite Value at risk Probability and size of potential losses/gains Objective(s) for control of the risk and desired level of performance 7. Risk Treatment & Primary means by which the risk is currently managed Control Mechanisms Levels of confidence in existing control Identification of protocols for monitoring and review 8. Potential Action for Recommendations to reduce risk Improvement 9. Strategy and Policy Identification of function responsible for developing strategy Developments and policy4.3 Risk Estimation Examples are given in the tables overleaf.Risk estimation can be quantitative, semi- Different organisations will find thatquantitative or qualitative in terms of the different measures of consequence andprobability of occurrence and the possible probability will suit their needs best.consequence. For example many organisations find thatFor example, consequences both in terms assessing consequence and probability as high,of threats (downside risks) and medium or low is quite adequate for theiropportunities (upside risks) may be high, needs and can be presented as a 3 x 3 matrix.medium or low (see table 4.3.1). Probabilitymay be high, medium or low but requires Other organisations find that assessingdifferent definitions in respect of threats and consequence and probability using a 5 x 5opportunities (see tables 4.3.2 and 4.3.3). matrix gives them a better evaluation.6 A Risk Management Standard
  9. 9. Table 4.3.1 Consequences - Both Threats and Opportunities High Financial impact on the organisation is likely to exceed £x Significant impact on the organisation’s strategy or operational activities Significant stakeholder concern Medium Financial impact on the organisation likely to be between £x and £y Moderate impact on the organisation’s strategy or operational activities Moderate stakeholder concern Low Financial impact on the organisation likely to be less that £y Low impact on the organisation’s strategy or operational activities Low stakeholder concernTable 4.3.2 Probability of Occurrence - Threats Estimation Description Indicators High Likely to occur each year Potential of it occurring several times (Probable) or more than 25% chance within the time period (for example - of occurrence. ten years). Has occurred recently. Medium Likely to occur in a ten Could occur more than once within the (Possible) year time period or less time period (for example - ten years). than 25% chance of Could be difficult to control due to occurrence. some external influences. Is there a history of occurrence? Low Not likely to occur in a Has not occurred. (Remote) ten year period or less than Unlikely to occur. 2% chance of occurrence.© AIRMIC, ALARM, IRM: 2002 7
  10. 10. Table 4.3.3 Probability of Occurrence - Opportunities Estimation Description Indicators High Favourable outcome is Clear opportunity which can be relied (Probable) likely to be achieved in on with reasonable certainty, to be one year or better than achieved in the short term based on 75% chance of occurrence. current management processes. Medium Reasonable prospects of Opportunities which may be achievable (Possible) favourable results in one but which require careful management. year of 25% to 75% chance Opportunities which may arise over and of occurrence. above the plan. Low Some chance of favourable Possible opportunity which has yet to be (Remote) outcome in the medium fully investigated by management. term or less than 25% Opportunity for which the likelihood of chance of occurrence. success is low on the basis of management resources currently being applied.4.4 Risk Analysis methods and treatment efforts.This ranks each identifiedtechniques risk so as to give a view of the relative importance.A range of techniques can be used toanalyse risks.These can be specific to This process allows the risk to be mappedupside or downside risk or be capable of to the business area affected, describes thedealing with both. (See Appendix, page 14, primary control procedures in place andfor examples). indicates areas where the level of risk control investment might be increased,4.5 Risk Profile decreased or reapportioned.The result of the risk analysis process can Accountability helps to ensure thatbe used to produce a risk profile which ‘ownership’ of the risk is recognised andgives a significance rating to each risk and the appropriate management resourceprovides a tool for prioritising risk allocated. 5. Risk EvaluationWhen the risk analysis process has been economic and environmental factors,completed, it is necessary to compare the concerns of stakeholders, etc. Riskestimated risks against risk criteria which evaluation therefore, is used to makethe organisation has established.The risk decisions about the significance of risks tocriteria may include associated costs and the organisation and whether each specificbenefits, legal requirements, socio- risk should be accepted or treated.8 A Risk Management Standard
  11. 11. 6. Risk Reporting and Communication6.1 Internal Reporting • have systems which communicateDifferent levels within an organisation need variances in budgets and forecasts atdifferent information from the risk appropriate frequency to allow action to bemanagement process. takenThe Board of Directors should: • report systematically and promptly to• know about the most significant risks senior management any perceived new facing the organisation risks or failures of existing control• know the possible effects on shareholder measures value of deviations to expected performance ranges Individuals should:• ensure appropriate levels of awareness • understand their accountability for throughout the organisation individual risks• know how the organisation will manage a • understand how they can enable crisis continuous improvement of risk• know the importance of stakeholder management response confidence in the organisation • understand that risk management and• know how to manage communications risk awareness are a key part of the with the investment community where organisation’s culture applicable• be assured that the risk management • report systematically and promptly to process is working effectively senior management any perceived new• publish a clear risk management policy risks or failures of existing control covering risk management philosophy and measures responsibilities 6.2 External ReportingBusiness Units should: A company needs to report to its• be aware of risks which fall into their area stakeholders on a regular basis setting out of responsibility, the possible impacts these its risk management policies and the may have on other areas and the effectiveness in achieving its objectives. consequences other areas may have on them Increasingly stakeholders look to• have performance indicators which allow organisations to provide evidence of them to monitor the key business and effective management of the organisation’s financial activities, progress towards non-financial performance in such areas as objectives and identify developments community affairs, human rights, which require intervention (e.g. forecasts employment practices, health and safety and budgets) and the environment.© AIRMIC, ALARM, IRM: 2002 9
  12. 12. Good corporate governance requires that The formal reporting should address:companies adopt a methodical approach to • the control methods - particularlyrisk management which: management responsibilities for risk• protects the interests of their stakeholders management• ensures that the Board of Directors • the processes used to identify risks and discharges its duties to direct strategy, build how they are addressed by the risk value and monitor performance of the management systems organisation • the primary control systems in place to manage significant risks• ensures that management controls are in • the monitoring and review system in place place and are performing adequately Any significant deficiencies uncovered byThe arrangements for the formal reporting the system, or in the system itself, shouldof risk management should be clearly stated be reported together with the steps takenand be available to the stakeholders. to deal with them. 7. Risk TreatmentRisk treatment is the process of selecting The risk analysis process assists the effectiveand implementing measures to modify the and efficient operation of the organisationrisk. Risk treatment includes as its major by identifying those risks which requireelement, risk control/mitigation, but attention by management.They will needextends further to, for example, risk to prioritise risk control actions in terms ofavoidance, risk transfer, risk financing, etc. their potential to benefit the organisation.NOTE: In this standard, risk financing Effectiveness of internal control is therefers to the mechanisms (eg insurance degree to which the risk will either beprogrammes) for funding the financial eliminated or reduced by the proposedconsequences of risk. Risk financing is not control measures.generally considered to be the provision of Cost effectiveness of internal control relatesfunds to meet the cost of implementing risk to the cost of implementing the controltreatment (as defined by ISO/IEC Guide compared to the risk reduction benefits73; see page 17). expected.Any system of risk treatment should The proposed controls need to beprovide as a minimum: measured in terms of potential economic• effective and efficient operation of the effect if no action is taken versus the cost organisation of the proposed action(s) and invariably require more detailed information and• effective internal controls assumptions than are immediately• compliance with laws and regulations. available.10 A Risk Management Standard
  13. 13. Firstly, the cost of implementation has to compliance.There is only occasionallybe established. This has to be calculated some flexibility where the cost of reducingwith some accuracy since it quickly a risk may be totally disproportionate tobecomes the baseline against which cost that risk.effectiveness is measured. The loss to be One method of obtaining financialexpected if no action is taken must also protection against the impact of risks isbe estimated and by comparing the through risk financing which includesresults, management can decide whether insurance. However, it should beor not to implement the risk control recognised that some losses or elements of ameasures. loss will be uninsurable eg the uninsuredCompliance with laws and regulations is costs associated with work-related health,not an option. An organisation must safety or environmental incidents, whichunderstand the applicable laws and must may include damage to employee moraleimplement a system of controls to achieve and the organisation’s reputation. 8. Monitoring and Review of the Risk Management ProcessEffective risk management requires a Changes in the organisation and thereporting and review structure to ensure environment in which it operates must bethat risks are effectively identified and identified and appropriate changes made toassessed and that appropriate controls and systems.responses are in place. Regular audits ofpolicy and standards compliance should be Any monitoring and review process shouldcarried out and standards performance also determine whether:reviewed to identify opportunities for • the measures adopted resulted in what wasimprovement. It should be remembered intendedthat organisations are dynamic and operatein dynamic environments. Changes in the • the procedures adopted and informationorganisation and the environment in which gathered for undertaking the assessmentit operates must be identified and were appropriateappropriate modifications made to systems. • improved knowledge would have helpedThe monitoring process should provide to reach better decisions and identifyassurance that there are appropriate controls in what lessons could be learned forplace for the organisation’s activities and that future assessments and management ofthe procedures are understood and followed. risks© AIRMIC, ALARM, IRM: 2002 11
  14. 14. 9. The Structure and Administration of Risk Management9.1 Risk Management Policy The Board should, as a minimum,An organisation’s risk management policy consider, in evaluating its system of internalshould set out its approach to and appetite control:for risk and its approach to risk • the nature and extent of downside risksmanagement.The policy should also set acceptable for the company to bear withinout responsibilities for risk management its particular businessthroughout the organisation. • the likelihood of such risks becoming aFurthermore, it should refer to any legal realityrequirements for policy statements eg. for • how unacceptable risks should be managedHealth and Safety. • the company’s ability to minimise theAttaching to the risk management process probability and impact on the businessis an integrated set of tools and techniques • the costs and benefits of the risk andfor use in the various stages of the business control activity undertakenprocess.To work effectively, the risk • the effectiveness of the risk managementmanagement process requires: process• commitment from the chief executive and • the risk implications of board decisions executive management of the organisation• assignment of responsibilities within the 9.3 Role of the Business Units organisation This includes the following:• allocation of appropriate resources for • the business units have primary training and the development of an responsibility for managing risk on a day- enhanced risk awareness by all to-day basis stakeholders. • business unit management is responsible9.2 Role of the Board for promoting risk awareness within theirThe Board has responsibility for operations; they should introduce riskdetermining the strategic direction of the management objectives into their businessorganisation and for creating the • risk management should be a regularenvironment and the structures for risk management-meeting item to allowmanagement to operate effectively. consideration of exposures and toThis may be through an executive group, a reprioritise work in the light of effectivenon-executive committee, an audit risk analysiscommittee or such other function that suits • business unit management should ensurethe organisation’s way of operating and is that risk management is incorporated atcapable of acting as a ‘sponsor’ for risk the conceptual stage of projects as well asmanagement. throughout a project12 A Risk Management Standard
  15. 15. 9.4 Role of the Risk Management management processes across anFunction organisationDepending on the size of the organisation • providing assurance on the managementthe risk management function may range of riskfrom a single risk champion, a part time • providing active support and involvementrisk manager, to a full scale risk in the risk management processmanagement department.The role of the • facilitating risk identification/assessmentRisk Management function should include and educating line staff in riskthe following: management and internal control• setting policy and strategy for risk • co-ordinating risk reporting to the board, management audit committee, etc• primary champion of risk management at In determining the most appropriate role strategic and operational level for a particular organisation, Internal Audit• building a risk aware culture within the should ensure that the professional organisation including appropriate requirements for independence and education objectivity are not breached.• establishing internal risk policy and 9.6 Resources and structures for business units Implementation• designing and reviewing processes for risk The resources required to implement the management organisation’s risk management policy• co-ordinating the various functional should be clearly established at each level of activities which advise on risk management management and within each business unit. issues within the organisation In addition to other operational functions• developing risk response processes, they may have, those involved in risk including contingency and business management should have their roles in co- continuity programmes ordinating risk management policy/strategy clearly defined.The same clear definition is• preparing reports on risk for the board also required for those involved in the audit and the stakeholders and review of internal controls and9.5 Role of Internal Audit facilitating the risk management process.The role of Internal Audit is likely to differ Risk management should be embeddedfrom one organisation to another. In within the organisation through thepractice, Internal Audit’s role may include strategy and budget processes. It should besome or all of the following: highlighted in induction and all other• focusing the internal audit work on the training and development as well as within significant risks, as identified by operational processes e.g. product/service management, and auditing the risk development projects.© AIRMIC, ALARM, IRM: 2002 13
  16. 16. 10. AppendixRisk Identification Techniques - Risk Analysis Methods andexamples Techniques - examples• Brainstorming Upside risk• Questionnaires • Market survey• Business studies which look at each • Prospecting business process and describe both the • Test marketing internal processes and external factors • Research and Development which can influence those processes • Business impact analysis• Industry benchmarking• Scenario analysis Both• Risk assessment workshops • Dependency modelling• Incident investigation • SWOT analysis (Strengths,Weaknesses, Opportunities,Threats)• Auditing and inspection • Event tree analysis• HAZOP (Hazard & Operability Studies) • Business continuity planning • BPEST (Business, Political, Economic, Social,Technological) analysis • Real Option Modelling • Decision taking under conditions of risk and uncertainty • Statistical inference • Measures of central tendency and dispersion • PESTLE (Political Economic Social Technical Legal Environmental) Downside risk • Threat analysis • Fault tree analysis • FMEA (Failure Mode & Effect Analysis)On the following pages are extracts from the document PD ISO/IEC Guide 73: 2002reproduced with the permission of British Standards Institution under licence number2002SK/0313. British Standards can be obtained from BSI Customer Services,389 Chiswick High Road, London W4 4AL. (Tel + 44 (0) 20 8996 9001)14 A Risk Management Standard
  17. 17. The Institute of Risk Management 6 Lloyd’s Avenue, Telephone 020 7709 9808 London EC3N 3AX Facsimile 020 7709 0716 Email enquiries@theIRM.org www.theirm.org ALARM The National Forum for Queens Drive, Exmouth Risk Management in the Public Sector Devon, EX8 2AY Telephone 01395 223399 Facsimile 01395 223304 Email admin@alarm.uk.com www.alarm-uk.com The Association of 6 Lloyd’s Avenue, Insurance and Risk Managers London EC3N 3AX Telephone 020 7480 7610 Facsimile 020 7702 3752 Email enquiries@airmic.co.uk www.airmic.com This publication is available from the above organisations for download from their respective websites free of charge.Please contact the individual associations if you wish to purchase more copies of this Risk Management Standard in printed form