Main components of the risk management process

Welcome to Risk Management!

Hello there! Welcome to one of the most practical chapters in your Business Management studies. If you have ever carried an umbrella just because the sky looked a bit grey, you have already practiced Risk Management.

In a business context, risk management isn't just about avoiding "bad stuff." It is a structured process to identify, analyze, and handle things that might stop a company from reaching its goals. Since this chapter falls under "Effective Control Systems," think of risk management as the "brain" that tells the "muscles" (the controls) what to do. Let's dive in!

1. The Risk Management Process: An Overview

Don't worry if this seems like a lot of steps at first. Think of it as a loop. Because the world changes, businesses must keep going through these steps to stay safe. Most frameworks follow these five core stages:
1. Objective Setting (What are we trying to do?)
2. Risk Identification (What could stop us?)
3. Risk Assessment (How bad would it be?)
4. Risk Response (What should we do about it?)
5. Monitoring and Reporting (Is our plan working?)

Step 1: Setting Objectives (Establishing the Context)

You cannot have a "risk" if you don't have a "goal." If your goal is to walk to the kitchen, a rug on the floor is a tripping risk. If you stay in bed, that same rug is not a risk to you.

In business, the board must decide the Risk Appetite—this is the amount of risk the company is willing to accept to achieve its goals.

Key Takeaway: Risk management always starts with understanding the company's strategy and goals.

2. Risk Identification: "What Could Go Wrong?"

In this stage, the business tries to list every possible event that could affect its objectives. To make this easier, we usually categorize risks into two buckets:

Internal Risks: Things happening inside the company (e.g., employee fraud, broken machinery, or IT system failures).
External Risks: Things happening outside (e.g., changes in government laws, a new competitor, or a global pandemic).

Example: If a Hong Kong cafe wants to expand, an internal risk might be a shortage of trained chefs. An external risk might be a sudden increase in the price of imported coffee beans.

Quick Review: Common Identification Methods

- Brainstorming: Getting the team in a room to shout out ideas.
- SWOT Analysis: Looking at Strengths, Weaknesses, Opportunities, and Threats.
- Checklists: Looking at a list of risks that happened in the past.

3. Risk Assessment: "How Big Is the Problem?"

Once we have a long list of risks, we can't fix them all at once—that would be too expensive! We need to prioritize. We do this by looking at two factors:

1. Likelihood: What is the probability of this happening?
2. Impact: If it happens, how much damage (financial or reputational) will it cause?

We use a simple formula to "score" a risk:
\( Risk \, Score = Likelihood \times Impact \)

Did you know? This is often visualized using a Risk Heat Map (a grid where one side is Likelihood and the other is Impact). High-impact, high-likelihood risks are "Red" and need immediate attention.

Understanding Inherent vs. Residual Risk

This is a common "trick" area in exams, so pay close attention:
- Inherent Risk: The risk level before you do anything to stop it (the raw risk).
- Residual Risk: The risk that remains after you have put controls in place.

Analogy: The Inherent Risk of fire in a kitchen is high. After you install a fire extinguisher and smoke alarm (controls), the Residual Risk is much lower, but it is never zero!

4. Risk Response: "The TARA Model"

Once we know which risks are the most dangerous, we must decide how to handle them. You can remember the four main strategies using the mnemonic TARA:

1. Transfer (or Share): You give the risk to someone else.
Example: Buying Insurance. If a fire happens, the insurance company pays for the damage.

2. Avoid: You stop the activity that causes the risk entirely.
Example: A company decides not to launch a product in a country with a very unstable government.

3. Reduce (or Mitigate): You take action to make the risk less likely or less damaging.
Example: Installing passwords on computers to reduce the risk of data theft.

4. Accept (or Retain): The risk is so small or the cost to fix it is so high that you just live with it.
Example: A shop accepts that occasionally a cheap pen might be stolen; it’s cheaper to lose the pen than to hire a security guard for it.

Common Mistake to Avoid:

Many students confuse Transfer and Avoid. Remember: In Transfer, you are still doing the activity (running the business), but someone else shares the financial pain. In Avoid, you stop the activity completely.

5. Monitoring and Reporting

Risk management is not a "one and done" task. The environment changes constantly.

Monitoring: Managers must check if the controls (like locks or software) are still working.
Reporting: The results must be communicated to the Board of Directors. They need to know if new risks have appeared or if the "Residual Risk" is still within their Risk Appetite.

Summary: Key Takeaways for Your Exam

- The process is a continuous cycle, not a straight line.
- Objective setting must happen before you can identify risks.
- Use the Heat Map (Likelihood x Impact) to prioritize risks.
- Remember TARA for risk responses: Transfer, Avoid, Reduce, Accept.
- Residual risk is what’s left over after you've tried to manage the risk.

Don't worry if this seems tricky at first! Just keep thinking about the "Umbrella" analogy. Why do you have it? (Objective: Stay dry). What is the risk? (Rain). How likely is it? (Check the weather report). What is your response? (Reduce the risk by carrying the umbrella). Happy studying!