Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
ACCT5919 -
Business Risk
Management
Lecture 2 – Risk Management Process
Agenda
COURSE ADMINISTRATION
Group allocations – finalise by Week 5 for Group Video Presentation
Individual assignment
• Overview of requirements
• Tips
Weekly quiz (starts week 3) - overview
LECTURE
Elements for effective risk management
Risk Management Framework (RMF) overview
RMF Activities
BREAK
CLASS DISCUSSION
Corporate Governance and Sustainability
What is Risk?
“The effect of uncertainty on objectives - effect is a deviation from
the expected - may be positive and/or negative – can address,
create or result in opportunities and threats; objectives can have
different aspects and categories and can be applied at different
levels, usually expressed in terms of risk sources, potential events,
their consequences and their likelihood”
Source:AS/NZS ISO 31000:2018
Why Manage Risk?
Purpose of Risk Management
Every organisation faces developments in its internal and external context which present
risk and uncertainty to the achievement of its objectives. Risk management is aimed at
helping the organisation achieve its objectives in an efficient and sustainable way.
All organisations manage risk to some degree, as a minimum, through reacting to events
and remedying the consequences.
A more effective risk management approach aims to be active so to prevent negative
events occurring in a consistent, efficient and coherent way. However, elimination of all
risk is not possible – risk management aims to implement treatments which reduce the
level of inherent risk to an acceptable residual level (appetite.)
What activities can an organisation use to manage risk?
Guidance is provided through standards and other definitional documents published by
educational, professional, regulatory and standards organisations.
International Standards Organisation (ISO) Risk Management 31000:2018 is often the
standard used.
Characteristics of an Effective Risk
Management Framework
Integrated
Customised
Inclusive
Human and
Cultural Factors
Dynamic
Risk Management Framework
Structured and
Comprehensive
Best Available
Information
Continual
Improvement
Risk Management Framework (RMF)
/ Process
Source:AS/NZS ISO 31000:2018
Often the activities are
performed in sequence once a
year across the whole
organisation as a holistic
exercise to provide annual
reporting to governance bodies
like the Board Risk Committee.
However, the activities are inter-
related and subsequent
activities can cause previous
activity results to be
reconsidered.
Some or all the activities can be
performed at any time in
response to internal and
external developments.
Communication and Consultation
Communication and consultation with external and internal stakeholders should occur
regularly during all stages of the risk management process. It is important to plan who is
involved, in what capacity (role) and when as this will define the communication and
consultation activities.
Some stakeholders will provide input (consulted) to the process, others will be primary
participants in performing the process, and others will be informed of the results of the
process and may be required to carry out actions
Communications should ensure everyone is informed as necessary to perform their role
effectively:
• The form and content of the communications need to be tailored so all relevant
information is provided at the right time and the appropriate level of detail, and in a
form that allows it be be understood and used effectively for their role.
• A consistent understanding of information across the organisation – language,
definitions and rules are important to be specified to achieve this.
Consultation process should ensure the relevant input and advice is received and used in
the process at the right time and in a form that is understandable and useful for risk
management process participants.
Communication and Consultation
(Cont.)
This aims of the communication and consultation process are:
• Participants have a clear understanding of the context and other information necessary
to make informed decisions
• The reasoning behind decisions and actions can be explained in a consistent and
understandable manner to recipients
• Required areas of expertise are bought to each relevant activity of the risk
management process
• There is appropriate consideration of alternate views when identifying and evaluating
risks and deciding risk treatments.
• Provide sufficient information to facilitate risk oversight, monitoring and assurance.
• Build inclusiveness and agreement among those managing and affected by the risk
(risk owners)
Scope, Criteria and Context
Establishing the Context
Internal
Context
External
Context
Risk Mgmt
Context
Develop
Criteria
Define the
Structure
Establishing the scope, context,
and criteria is a critical first step
before undertaking a risk
assessment. It is the critical
information that participants need
to understand consistently to
perform their role in the RMF.
The scope will define what the
process needs to cover, and the
criteria will define the concepts
upon which the process is based.
That will provide a common
language and consistent set of
rules for decision-making.
This should assist in providing a
structured, comprehensive and
consistent process and output.
Scope, Criteria and Context (Cont.)
Scope
Defining the scope provides an understanding of:
▪ What risks are to be covered
▪ What business unit(s) / activities the risk management process are to be covered
▪ Why the risk management process is being undertaken and which activities in the process are to
be performed
▪ What information is to be provided to participants
▪ What objectives and outcomes the business unit(s) / business activities support
▪ Who (groups or individuals) are to be involved in the process (including external stakeholders)
▪ What is not covered by the risk management process
▪ What resources might be required
▪ Who is accountable and responsible for the output (actions) from the risk management process
Scope, Criteria and Context (Cont.)
Criteria
Defining the criteria provides an understanding of the mechanics of the process and how to report the
output for the process including:
▪ Terms and definitions providing a common risk language
▪ Risk classifications and inventory
▪ Basis for identifying new risks or changes in level of risks – what context to consider
▪ Time horizon for assessment
▪ Criteria, scale and rules for risk measurement and assessment – consequence and likelihood
▪ Defined risk appetite - concepts and current appetite
▪ Types of risk treatments to be used
▪ Reporting requirements – organisation structure, levels of detail of reporting, presentation
formats and content
▪ Risk ownership rules
▪ Methods for aggregation of risk measurements
Scope, Criteria and Context (Cont.)
Understanding the internal and external environment (context) within which the
organisation operates is aimed at ensuring all relevant developments and changes that
may affect risk levels or create new risks relevant to the achievement of its objectives
can be identified and assessed.
Strategic Context (external influences – general and industry specific)
• The general (jurisdiction level) environment in which the organisation operates –
political, economic, society, technology, physical environment, legal.
• Industry specific developments –, competitor developments, industry legal and
regulatory developments, industry technology, supply chain, customer preferences
• Involves a determination of changes in what the external stakeholders expect from
the organisation
• Will influence and be influenced by the organisation’s market positioning, strategy
and reputation
These help to shape decisions on what risks are desirable
Scope, Criteria and Context (Cont.)
Organisational Context (internal influences)
• The organisation’s capabilities
• Objectives and strategies in response to stakeholder expectations
• Policies
• The culture of the organisation
• The extent of senior management commitment to the risk management process
These help to shape decisions on what risks are acceptable
The Risk Management Process Context
• The risk culture
• The role of risk management in achieving organisational goals
• The dynamics of the risk-return trade-off - appetite
• The extent to which risk management practices promote value creation
• The extent of the integration of risk management into organisational activities and
staff KPI’s
These help to shape decisions on what risks are manageable
Scope, Criteria and Context (Cont.)
Organisational Context (internal influences)
• The organisation’s capabilities
• Objectives and strategies in response to stakeholder expectations
• Policies
• The culture of the organisation
• The extent of senior management commitment to the risk management process
These help to shape decisions on what risks are acceptable
The Risk Management Process Context
• The risk culture
• The role of risk management in achieving organisational goals
• The dynamics of the risk-return trade-off - appetite
• The extent to which risk management practices promote value creation
• The extent of the integration of risk management into organisational activities and
staff KPI’s
These help to shape decisions on what risks are manageable
Identify Risks
The purpose of the risk identification activity is to highlight threats to objectives and the nature of the
impact of those threats if actions are not being taken to mitigate them. Critical to this activity is:
• an understanding of the objective
• what the sources of threats can be – there may be more than one
• how the threat affects the achievement of the objective – type of impact.
Success depends on developing a well-understood risk description that explains the above factors
and assigning it to the locations (units, departments) in the business where this risk is relevant and a
single risk owner at the appropriate level of the organisation based on the location of the risk.
Effective risk identification and clear risk descriptions will support subsequent activities in the process
– informed decisions on level of risk (assessment) and effective risk treatments.