Diploma in Risk Management

Risk Analysis &

UNIT-4 Assessment

Learning Outcomes
By the end of this unit, the student will be able to

 discuss the phases involved in Risk Management processes.

 determine the effectiveness of existing Risk Management processes.
Diploma in Risk Management

Unit 4
Risk Analysis & Assessment
The core risk-management stages are identified as analysis, identification, assessment, evaluation,
planning, and management. These stages collectively create a logical sequence of activities essential for
a forceful approach towards the application of enterprise risk management.

Process Map of the Risk Management Phases

Risk Analysis

Risk Identification

Risk Assessment

Risk Evaluation

Risk Planning

Risk Management

An analysis of the business is the initial step of the six-stage process of Enterprise Risk Management
(ERM). An analysis of the business deals with acquiring an understanding of

1. the entire background to the business in general terms.

2. the specific business activity, process or project to be studied for risk management.

As this stage offers the basic foundation for all activities that follow, the quality of the remainder of the
Risk Management process will depend on how well this process is completed.

The objective of the first stage is to determine timely and accurate data. However, the degree of the
usefulness of this stage will depend on its scope, depth, relevance, and correctness, in terms of providing
appropriate insights for creating an effective tool with substance. Representatives of the business under
Diploma in Risk Management

examination often become frustrated by the time required for the investigation or regard the activities
such as investigation, research and diagnosis as expensive and wasteful.

Before collecting any data, a decision must be made regarding the approach to be used and the area to
be investigated.

This will be determined by the focus of the study, such as whether it is an analysis of

 A single business activity or project

 Asingle department’s on-going or planned activities within a business
 A proposed merger or acquisition
 A new production facility oversees

Or

 Health checks of existing risk management procedures

 Health checks of a single investment proposal, business case model, or quantitative project risk
model

Process

Each stage is a distinctive process in and of itself. Thus, each process must be measured against precise
process goals that indicate the contribution that the process is expected to make towards the risk-
management study. Processes are easier to understand when they have primary and sub-goals;
therefore, analysis is described as having a primary process goal which is accomplished by a series of
sub-goals.

Any single process is accomplished within a context and has two perspectives, the internal and the
external views. The external view identifies the process inputs, outputs, mechanisms, and controls. The
internal view examines the process activities that transform inputs into outputs by applying the
mechanisms and being influenced by the controls.

Process Goal and Sub-Goals

The main process goal of analysis, which is the first stage in the Risk Management process, is to
understand the business processes as input for the next stage in the overall Risk Management process.

While realizing that the analysis stage will be customized to suit the specific requirements of the study or
assignment when the overview of the entire business is being acquired, the analysis stage will be
satisfactory when it fulfils these sub-goals:

 Business objectives are defined.

 An organogram of the business structure is constructed.
Diploma in Risk Management

 The business process map has been examined or a high-level process map has been
developed, if it did not exist already.
 The existing internal controls are established and evaluated.
 All the primary business functions are studied.
 The prevailing corporate Risk Management plan is studied, along with the concerns of the audit
committee.
 The business risk appetite is made obvious.
 The existing risk register is reviewed.
 No departments are excluded and personnel from all suitable company departmentsare involved.
 Department representatives taking part in the analysis process are sufficiently senior to be
well-informed about their own area of expertise, and be aware of both company risk exposure
and past corporate lessons learnt.
 Consultation is done with non-executive directors and where appropriate, they are included in
the process of risk identification.

Analysis Process Illustrating the Inputs, Outputs, Constraints, and Mechanisms

Fig: 4.1

Process Inputs

All processes should be tailored to suit the study requirements.

However, the following are suggested inputs for the analysis process:

Business goals are the statements of business objectives against which success is measured. They must
be short, easy to understand, and long-lasting. Ideally, they should consist of no more than five bullet
points to be conveniently memorised and recalled.
Diploma in Risk Management

Simply put, the business plan is a statement of how the business will achieve its business objectives. The
length, style and content of a business plan will be determined by the audience for whom the plan is
prepared and the business decisions or activities that the plan is designed to accommodate. It describes
why the forecast time and effort will be worth the expenditure to achieve the change and the required
benefits.

A Business Process Map uses workflow diagrams and supporting text to describe every important step
in a company’s processes. It is an important management and communication tool used to facilitate
understanding of existing processes and to remove or simplify those that require change. It also
documents the sequence of activities to be undertaken. When a process map has been developed, it will
be an important asset enabling personnel to quickly understand the business processes, how they
interlink, and to understand what the potential sources of risk are.

An organogram is a chart that illustrates the organisational structure of the business and should align
with the objectives and vision of the business. The organisational structure reflects the responsibilities
for delivering margin and takes into consideration the elements of the value chain. It categorises the
reporting lines, span of control and sometimes staff numbers. Reporting lines identify information flow,
power, and responsibilities.

A value chain is a consistent policy thread throughout all business activities. Value-chain analysis
explores the configuration and linkage of different activities that form a chain, from raw materials to
processing, manufacturing, packaging, distribution and retailing to the end consumer. Through analysis,
a strategy mismatch between different elements of the value chain can be identified. For example, if a
company competes through low costs, then every part of the value chain should be geared towards
keeping costs low. If the policy is to keep stocks to a minimum in order to respond to fluctuating
customer tastes and not be left with redundant stock, each element of the business activity chain should
be geared around just-in-time management.

The audit committee is responsible for checking the integrity and comprehensiveness of a company’s
financial statements, specifically to establish whether management has adopted appropriate accounting
policies and supports them with realistic judgements and estimates. The audit committee may also be
closely involved in reviewing the effectiveness of the company’s risk management system, unless other
arrangements have been made by the board.

Internal controls are the tools used to ensure that the company’s policies are implemented, the
organisation’s values are upheld, required processes are met, compliance with laws and regulations,
financial statements and other published information are accurate and consistent and that human,
financial and other resources are managed efficiently and effectively.

A Risk Management Plan is a map of the intended implementation of risk management to support a
project or business activity. A risk-management plan will generally describe the objectives of the risk
Diploma in Risk Management

study, overview of the project, the timeframe for the risk study, resources required, risk management
processes, duties of the parties and the deliverables of the study.

Projected financial statements display the predicted financial outcomes of following a specific course of
action. By studying the financial implications of specific decisions, managers should be able to allocate
resources in a more efficient and effective manner. The projected financial statements will normally
include a cash flow statement, profit and loss accounts, and a balance sheet.

The Marketing Plan documents a detailed description of the marketing mix and guidelines for
implementing the company’s marketing programmes. The marketing mix is defined by the four Ps:
product, price, promotion and place. A combination of all elements of the marketing mix is termed the
offer. The offer is more than simply the product; it is a value proposition that satisfies the customers’
needs. The marketing mix defines the attributes of the offer.

Ratios’ analyses provide a picture of a firm’s vulnerability, performance, liquidity, profitability, and
efficiency.

Process Outputs

The findings of the business analysis are the process outputs. These findings should be recorded and
included in the report to be prepared at the completion of the study. There should also be an appendix
in the report listing the documents referred to, their title, date and author; in case further reference
needs to be made to them. The findings will act as inputs for the identification process.

Process Controls (Constraints)

The Business Risk Management culture, resources, studies, and plans are said to be regulating or
constraining the risk identification process.

 The Business Risk Management culture will constrain the risk identification process in terms of
the degree of significance, commitment and enthusiasm attributed to the process and the extent
of support given when the risk management process begins.
 Resources required for risk management may constrain risk identification in terms of time. When
cost is a constraint, especially when external support is being utilised, less expensive and most
likely less experienced staff may be selected for the task. When time is limited and risk
management activities are fast-tracked, there is a strong probability that the quality of the output
will be reduced. All of these constraints will probably compromise process effectiveness,
especially the scope of risk identification, potentially leaving blind spots.
 The risk management study itself will constrain the risk identification process if
 there is no clear focus for the study.
 the activities are too ambitious for the timescale.
 people attending interviews or workshops are not given sufficient notice.
Diploma in Risk Management

 the purpose of the study, timetable of events and their expected involvement is not explained
satisfactorily.
 the facilitator is not suitably experienced.
 the facilitator and attendees are inadequately prepared.
 participants are not familiar with the process, terminology, and outcomes of risk
managemen.;
 the timetable does not suit key participants, so they don’t attend.
 attendees bring additional personnel on their own, without the sponsor’s permission.

This leads to an inadequate study from several perspectives, the most serious of which is that the risk
study may be too superficial or narrow, leading to a series of blind spots across the possible sources of
risk.

 The Risk Management Plan will also constrain the risk identification process if roles and
responsibilities are unclear, business objectives are not documented, and sent to participants, the
studies are not scheduled and diarised in advance and the purpose of the process is not clear.

Process Mechanisms

There are four common process mechanisms:

 Financial analysis tools (ratios)

 The Risk Management Process diagnostic
 SWOT analysis
 PEST questions

Ratios

Various aspects of a company’s financial position and performance can be identified using financial
ratios. They are widely used for planning, management and evaluation purposes. Financial ratios help to
assess the financial wellbeing of a business and can be used by management in a variety of decision
making activities; such as profit planning, pricing, managing working capital, financial structure and
dividend policy. Financial ratios provide a quick and comparatively easy means to examine a company’s
financial condition. A ratio simply expresses the relation of one figure to another figure appearing in the
financial statements, for example, net profit in relation to capital employed, or perhaps some other
resource of the business. Ratios can be placed into certain categories, each of which reflects a particular
aspect of financial performance. The following broad categories are a useful basis for explaining the
types of financial ratios:

Profitability:The primary objective of starting a business is to create wealth for the owners. Profitability
ratios offer valuable insights into the degree of success that the management has attained in achieving
Diploma in Risk Management

this goal. Ratios express profits in relation to other important figures in the financial statements or
business resources.

Efficiency:Ratios can be used to assess the efficiency with which particular resources have been used
within the company. Such ratios are also known as activity ratios.

Liquidity:Liquidity is a very important measure of risk exposure. It is important for a business to have
sufficient liquid funds available to meet obligations as and when they mature. Ratios may be calculated
to examine the relationship between liquid resources held and creditors whose payments will be due in
the near future.

Gearing:Gearing is the relationship between the amount of money provided by the owners of the
company and the amount provided by outsiders.It has an important effect on the degree of risk
associated with the business. Gearing holds grave significance for managers who must take it into
consideration while making financing decisions.

Investment:Certain ratios are related to the assessments of the returns and performance of shares held
in a specific company.

Key aspects of calculating ratios to help risk analysis:

 The liquidity ratio would be of sufficient importance where there is a risk relating to the inability
to repay amounts owing in the short term.
 The profitability, investment, and gearing ratios are used to establish risk to returns on
investment.
 The profitability and gearing ratios would help in the event that there was concern by long-term
lenders over the long-term viability of the business.

Risk Management Process Diagnostic

Risk Management is a basic building block of business management. ERM studies, which focus on the
effectiveness of existing risk-management processes, will have to establish how efficient the current risk-
management processes are and how effectively they have been implemented in the business.

Establishing the Effectiveness of ExistingRisk Management Processes

The collaboration suggests that the effectiveness of existing formal risk-management procedures can be
assessed by performing a review. The aim of such a review would be to benchmark the company’s
current maturity and ability to manage risk, using a generally accepted tool such as a risk maturity
model, which is sometimes referred to as a process diagnostic. Comprehensive risk maturity models are
useful tools used to understand the degree of sophistication of a business risk-management process, its
reliability and efficiency in identifying, evaluating and managing risks and opportunities. Risk Maturity
models provide guidance to companies that need to develop or improve their approach towards risk
Diploma in Risk Management

management, helping them to evaluate their current level of maturity, establish realistic targets for
improvement and develop action plans to increase their risk capability.

SWOT Analysis

The acronym SWOT stands for Strengths, Weaknesses, Opportunities, and Threats. The SWOT analysis
headings offer a structure for reviewing a business as a whole or any specific issues including a strategic
alternative, an opportunity for an acquisition, a possible partnership, a new product, a business proposal,
or outsourcing an activity.

A SWOT analysis is a subjective evaluation of data, which is organised by the SWOT format into a logical
order that facilitates understanding, presentation, debate and decision making. The SWOT analysis
template is generally a grid comprising four sections, one for each of the SWOT headings:

 The analysis of the firm (internal features)

 The market analysis (internal and external features)
 The product, portfolio, and matrix analysis (internal and external features)
 The analysis of the general environment (external features)

PEST Analysis

A PEST analysis is used for analysing a business, specifically to understand market decline or growth.
PEST is an acronym for Political, Economic, Social, and Technological factors. This is a business
measurement tool used to evaluate the market for a business or organisation.

Businesses are continuously reacting to changes in the environments in which they operate. Proactive
businesses try to anticipate changes in their external environment by observing trends through practices,
such as market research. This enables them to plan and prepare. Reactive businesses have to decide
what to do after a change has occurred and, because they have been taken by surprise, they generally
tend to be faced with one crisis after another. Because of this, decision-making is less effective as they
have to rush into making significant decisions without sufficient information. In order to make effective
decisions, businesses should be constantly monitoring their environment to identify potential changes
and risks and prepare for them.

A PEST analysis of Political, Economic, Social, and Technological factors will identify most of the external
environmental influences on how a business performs. These influences are part of the macro
environment over which the business has no control. An initial PEST analysis can be performed as part of
a desktop study and then used again with a project team or business group to identify external
influences and gain the consensus of senior managers.
Diploma in Risk Management

Process Activities
The Stage 1 risk study process activities will be determined by the study objectives, therefore they will
have to be customized to suit the information that has to be collected. The activities will consist of some
or all of the activities listed below, depending on the scope of the risk study. An in-depth understanding
of the company operations will be needed and the context within which they operate, for which a high-
level process map must be created of the company’s activities or a risk breakdown structure to aid risk
identification. Thefollowing activities should be identified and examined.

 Business objectives or the business objectives subset

 The business plan
 Understanding of the industry, including the business position, market context, and regulatory
framework
 Business processes
 Projected financial statements
 Resources
 Change management
 Marketing plan
 Compliance systems
 Internal controls, the role of the Audit Committee andreview of the existing risk-management
processes

Business Objectives

Understanding and documenting the business objectives is the first and most important activity. Process
2 is the next part of the risk management process. The purpose of the study will be to identify the risks
and opportunities in relation to the business objectives. The success of the business strategy will be
measured against these criteria. The business strategy is the overall plan aimed at achieving sustainable
competitive advantage to produce good profits.

The objectives should be SMART:

 Specific
 Measurable
 Achievable within the timeframe included in the business strategy
 Relevant to the business vision
 Time bound
Diploma in Risk Management

Business Plan

It is important to examine the business plan thoroughly, as it should provide a story. The story must
explain how the business will reach its objectives in a clear, consistent, and cohesive manner and it
should be focused on the customer. The plan has to ascertain the target customers, the market, its
growth prospects and the main competition. It should be based on reliable assumptions and should also
identify the assumptions that the business is most sensitive to. It should define the risks the business is
facing, the scale of the downside risks if they should occur and the actions planned to minimise or
eradicate the risks. As the blueprint for the business, it should identify what makes the business different
from its competition, its USP (unique selling propostion), and how it will maintain its competitive edge
over the long run. It should identify the experience and past performance of the executive team and for
larger companies, provide similar details for people who hold key support positions in implementing the
business. In addition, it should also identify the source of funding and the cost of that funding for the
business.

When viewed as part of a risk study, the relevancy of the plan should be established, mainly the market
analysis.

A checklist for a good business plan is as follows:

 Tell a clear, cohesive, customer focused story.

 Clearly identify the customers, market, suppliers, and competitors.
 Contain credible sales forecasts and planning assumptions.
 Explain how the business will accomplish a sustainable competitive edge.
 Identify the assumptions to the business to which it is most sensitive.
 Identify the risks that the company faces and the planned or on-going response actions.
 Identify the opportunities that the business plans to exploit.
 Create a summary of the experience of the managers and key staff involved in managing the
business.
 Identify the funding requirements and the source(s) of funding.

By studying the business plan against this checklist, the risk analyst will identify yearly indications about
whether there are any important gaps in the business strategy that could possibly cause the loss of
potential opportunities or pose threats.

Examining the Industry

Diploma in Risk Management

The risk analyst needs to understand the industry within which the business is operating and the
competitive powers within that industry in order to understand the risks that the business faces.
Questions to be answered include the following:

 What is the present size of the industry?

 What are the major trends and changes in the industry?
 Who are the competitors and what are their present strengths?

Methods for industry analysis used to gain an understanding of the contexts of the organisation are an
industry overview, the industry lifecycle, structural analysis and main competitor analysis.

Industry Overview: Some elementary data about the sector relevant to the business being examined
must be collected. This may include pertinent metrics, such as:

 The annual sales in value for the last three years

 The annual unit or volume sales for the last three years
 The trend in prices for the last three years
 A measure of capacity and possibly capacity utilisation

Competitors’ names and their market share should be put together on a list. This information needs to
be sorted using a measure of concentration, such as the top 20% of competitors serves 80% of the
market.

The Industry Lifecycle: The industry lifecycle is measured in total industry sales over time. An industry’s
structure and various competitive forces form the environment in which businesses operate. This
environment keeps changing continually all through the life cycle.

Structural Analysis: An industry is an open system that is influenced by potential entrants, suppliers,
buyers and the threat of competition from substitutes. Sound understanding about the structure of an
industry is the foundation for designing a competitive strategy.

Main Competitor Analysis: Any organisation of substance will have carried out a market analysis. The
strength of the competition or rivals will have an important impact on the ability of the business being
studied to generate suitable margins.

Projected Financial Statements: Projected financial statements illustrate the predicted financial
outcomes to be earned by adopting a specific course of action. Managers should be able to allocate
resources in a more efficient and effective manner by examining the financial implications of certain
decisions. The projected financial statements generally consist of a cash flow statement, profit and loss
account and a balance sheet. Several projected statements can be drawn up when there are competing
choices for each of the options being considered. The statements will itemise the expected income and
Diploma in Risk Management

costs for each option and will highlight the effect of these items on the future profitability, liquidity and
financial position of the organisation. Where executives are only considering one course of action,
projected financial statements can still be very useful. Preparing projected statements will still offer
useful insights into the outcome of a specific course of action on the prospective financial position of the
business.

Generally, the starting point for preparing projected statements will be the sales forecast. The capability
to sell the services or goods produced is the key factor which helps to decide the general level of activity
for the organisation. Therefore, a trustworthy sales position is as essential as many other issues including
certain costs, financing requirements, fixed assets and stock levels, and will be defined partially or
completely by the level of sales for the period.

A number of factors will influence future sales, like the extent of competition, the expenditure planned
for advertising, the quality of the product or service, economic conditions and fluctuations in consumer
tastes. Some of these aspects can be controlled by the organisation, others cannot. If useable figures are
to be produced, the sales forecasts must address all of the relevant factors. Sales projects can be based
on economic models, market research or statistical techniques.

A projected cash flow statement is beneficial as it helps to identify fluctuations in a company’s liquidity
over time. Cash may be called the lifeblood of a business. A business must have adequate liquid
resources to meet its on-going needs. Not having an adequate level of liquidity will have devastating
consequences for a company. The impact of expected future events on the cash balance can be assessed
by using the projected cash flow statement. It will pinpoint periods where there are cash shortfalls and
surpluses and will allow managers to plan for these situations. While forecasting costs, it is important to
remember that some costs are not affected by the level of sales in the period, while others will change
directly and proportionately with the level of sales. Examples of variable costs that fluctuate directly with
sales output are cost of sales, materials consumed and commission of the sales force. Fixed costs are
stable during the period irrespective of the level of sales generated. Examples of fixed costs are
depreciation, rent, rates, insurance and salaries. Semi-variable costs have both, a fixed and a variable
element and may vary partially with sales output.

A projected profit and loss account provides insights into the level of profits that can be expected. All
revenue that has been realised or achieved within the relevant period should be included when
preparing the profit and loss account. All expenses, including non-cash items such as depreciation that
relate to the revenue realised in the period must also be shown in the profit and loss account in which
the sales appear. The timing of the cash outflows for expenses is immaterial.

A projected balance sheet reveals the end-of-period balances for capital, assets and liabilities and should
generally be the last of the three statements to be prepared. The reason for this is that the previous
statements will supply information that is needed when preparing the projected balance sheet. The
Diploma in Risk Management

projected cash flow statement reveals the end-of-period cash balance for inclusion under the current
assets.

The projected profit and loss account reveals the projected profit or loss for the period for inclusion
under the share capital and reserves section of the balance sheet. In terms of forecasting balance sheet
items, the figures for items on the balance sheet of a business generally increase automatically with an
increase in sales levels. An increase in the sales levels should lead to an increase in the level of current
assets where an organisation will probably require

 more cash to deal with the increased costs.

 higher levels of trade debtors due to higher sales.
 more stock to meet the escalated demand.

In addition, increased levels of sales should also result in an increase in the current liabilities level. A
business will possibly acquire more trade creditors due to increased purchases and higher accrued
expenses as a result of increased overheads. Once prepared, the projected financial statements should
be examined thoroughly by executives. The danger exists that the figures in these statements will be
accepted too easily by people without a financial background. Questions like the following should be
asked:

 How reliable are these projections?

 What underlying assumptions have been used and are they effective?
 Have all applicable elements been included?

Answers to a variety of questions concerning the future performance and position of the business can be
found by examining the projected statements.

These questions include:

 Are the cash flows adequate?

 Is additional financing required?
 Can excess funds be reinvested profitably?
 Is the level of profit satisfactory to the risks involved?
 Are sales at an acceptable level?
 Is the financial situation at the end of the period satisfactory?
 Is the level of borrowing tolerable?
 Is the dependency on borrowing within limits?

Resources

Identifying an organisation’s resources and examining how these resources are used to gain competitive
advantage is one method of analysing a business. Businesses that focus on allocating and deploying their
Diploma in Risk Management

resources in the most effective manner will achieve a greater return on employed capital than those that
do not. When an analysis of a company’s resources is done, three aspects must be addressed:

The Resources Themselves: Resources can provide a competitive advantage because rivals may not have
access to similar resources and may not be able to replicate these within their own company in terms of
number and experience.

The Configuration of the Resources: Resources can provide a competitive advantage, which equates to
an opportunity. If a company’s resources are configured optimally, it will have a competitive advantage
over its competitors. This perspective is fundamental to the value chain and value system concept of
competitive advantage. Value-chain analysis is an analytical tool for adding value for an enterprise.

The Resource Audit: This evaluates human, operational and financial resources. A resource audit
identifies resources and establishes how effectively these resources are being deployed and used.

Change Management

Change leaders cannot blindly apply a standard change recipe and hope that it will work. No one solution
fits all circumstances. Successful change takes place on a path that is applicable for the specific situation.

Marketing Plan

The central force determining a company’s competitive position is the rivalry among businesses.
Therefore, it is necessary to analyse competitors. The elements of a competitor analysis are:

 Existing positioning or strategy

 Strengths, weaknesses, opportunities, and threats (SWOT)
 Probable strategy changes
 Financial strength
 Operational strength
 Resource strength
 Research and development strength

Markets are becoming more unpredictable and complex; however, companies are able to sense and
react to competitors at a faster rate due to technology and information flows. This rapidly moving
competition means companies cannot wait for a competitor to make a move before deciding how to
react.

The new watch words are anticipation and preparation as companies need to be ready for every
eventuality. Rapid countermoves meet every move of a competitor ensuring that any advantage is only
momentary. Sony, a household name in digital consumer electronics, was both astonished and seriously
affected when Apple made waves with their iPod, especially since this was a market that Sony had
pioneered with its Walkman.
Diploma in Risk Management

Compliance Systems

Business pressures arising from the regulatory organisations and the consequences for failing to comply
need to be well understood and documented. Any analysis of a business should understand the
regulatory environment in which the organisation operates. For example, compliance systems would be
very important for utility, pharmaceutical, defence, and the nuclear and financial sectors.

Conclusion

To implement the first stage in the entire risk-management process, an analysis process is critical for
achieving quality results for any risk-management study. Analysis will be important in acting as a prompt
to interrogate the sources of risk, identify the essential participants in any identification process and
identify the subjects that should be inspected closer. All analysis efforts must be tailored to suit the
objectives of any risk management study. The process activities should look at the business objectives,
the marketing plan, resources, plan and processes, financial statements, and change management.

Further Reading:

 Linda S. Spedding, Adam Rose, (2008), Business Risk Management Handbook: a

Sustainable Approach
 Edmund H. Conrow, (2003), Effective Risk Management: Some Keys to Success
 David Vose, (2008), Risk Analysis: a Quantitative Guide