Business Risk Management questions

Australian School of Business

Australian School of Business

Business Risk Management Week 8

Risk Management Systems - Control Systems and

the Management of Risk

Australian School of Business

This Week’s Objectives

• The various approaches to risk management leading to the need to control risk exposures

• The significance of Control in the risk management process and risk monitoring stages –Control’s dual role in risk management

• The determination of appropriate control systems in an organisation

• The affect of the culture of the organisation on its control structures and strategies

• Simons’ “Levers of Control”

Australian School of Business

The Options in Managing Risk

• Birkett Section 4.3.3 lists 5:(with Borge’s strategies) – Risk avoidance

• Preventing the risk – Risk reduction

• Diversifying or concentrating risks – Risk transfer

• Insurance, hedging or selling risks – Risk sharing

• Organisations generally, the corporation specifically – Risk retention/acceptance

• Including creating or buying risks

Australian School of Business

Risk Avoidance

• Involves refusing to accept the risk irrespective of the potential rewards

• Adopt alternative strategies or courses of action

• If adopted may deprive the business of profitable trading opportunities

Australian School of Business

Risk Reduction

• Implement prevention and control programmes

– Concerned with the affecting the occurrence and severity of loss,

• Fire detection systems

• Systems and processes designed to reduce the incidence of fraud or error

• Need to carefully weigh cost/benefits

• Risk aggregation

– This is one way that insurance companies manage their risks

• Risk diversification

– May also involve adopting multiple strategic positions (refer to the sessions on Strategic Risk)

This may render the risks more tolerable

Australian School of Business

Risk Transfer

• Contractual arrangements –warranty claims, penalties for delays, interest or

exchange rate risk

• Insurance –one party indemnifies the other for any loss which

may arise as a result of the occurrence of a risk event

• Hedging –Futures, Forwards and Derivatives

Australian School of Business

Risk Sharing

• Risks of an individual person or entity are transferred to a group –banding together (villages or clans or nations)

–the modern corporation

–managed funds

–Lloyds “names”

Australian School of Business

Risk Retention

• Conscious or unconscious –recognise the risk and accept it

–or the risk is not recognised

• Voluntary or involuntary –the existence of the risk is recognised and it

is accepted

–the existence of the risk is recognised but its incidence or severity cannot be affected

Australian School of Business

Managing Risks that are Retained

• If we retain risks can we do anything about managing them?

• How can we decide if this was a wise decision (assuming the risks were voluntarily accepted)?

We will want to monitor and measure them and ensure that they are under

control

Australian School of Business

What is Control?

• The exercise of powers taken or given within zones of discretion

• Accountability forms of control where there is some form of autonomy

• The appropriateness of risk management processes under change conditions

• Reporting on the effectiveness of the exercise of powers is required: –performance measurement

–reporting is a crucial element of control processes

Australian School of Business

Risk and Control

• Control performs two functions in risk management processes:

• Controls enable risks that are seen as excessive to be managed (Risk Reduction) – They alter behavior and the way people in the organisation respond to

risk events or the potential for risk events to occur

– They are focused on affecting either or both the likelihood or impact of risk events.

– This is the part of the Risk Management stage of the risk cycle

• Control is also about ensuring that the processes are functioning as intended according to Birkett (Monitoring) – In this capacity control identifies whether risk management actions are or

have been effective

– This is part of the Risk Monitoring stage of the risk cycle

Australian School of Business

What are Risk Parameters?

• Risk parameters establish the significance of an exposure –Its underlying causes or drivers –How the cost benefits of managing the risk can be

assessed

• The cost benefits alternatives for dealing with the risk –How significant were community safety issues in the BP

case? –What were the cost-benefit trade-offs that the BP took in

implementing is control systems? –How has this changed since?

Australian School of Business

Control and Risk Strategies

• Control must be aligned with –The risk management processes –The organisation’s culture

• Control is part of governance and broader management processes –Was control aligned with risk mitigation strategies at

Maytag? –How was the apparent absence of control reflected in

governance arrangements at Parmalat?

Australian School of Business

Risk Treatment

– This involves deciding the general strategy or strategies to be adopted, then devising treatment plans to implement the chosen strategy(ies)

– Treatment plans chosen need to be checked against the organisation’s risk appetite to ensure appropriateness

– Factors involved in deciding treatment options include:

• Cost effectiveness • Administrative simplicity • Interaction with existing risk treatment controls

Australian School of Business

Risk Treatment - Preparing Mitigating Plans

– When treatments are selected, it is important to evaluate the treatment plan to ensure it’s appropriate

– The treatment should also be documented, usually in a risk register

– A treatment owner should be identified if not the risk owner

– A monitoring and review schedule should be implemented to enable testing of the effectiveness of the treatment

Australian School of Business

The Structure of Control Systems

• In Week 1 we examined four cultural archetypes and the related control environment: – Communal control - Clans – Contractual control - Markets – Administrative control - Hierarchies – Subsumptive control - Fiefs

• The culture of the organisation is likely to influence the balance of controls applied – Note however all forms will probably be applied to

some degree in any organisation – Its more about the balance of controls

Australian School of Business Levers of Control - Diagnostic Control Systems

• Like dials in the aeroplane cockpit –Signs of abnormal functioning –Performance is measured against predetermined limits

and goals

• Focus on the right performance variables –What matters most? –Changes in limits and goals can lead to unintended

outcomes

• What performance variables were focused on at BP? – Were these the wrong performance variables?

• Diagnostic Control systems are slanted towards Hierarchical cultures

Australian School of Business

Simons’ Levers of Control - Belief Systems

• Statement of Values, credos – Identifies acceptable behaviour – Have to be broad in order to be relevant to diverse

groups – Must reward integrity – Assists in making choices and may motivate employees

• Management must reinforce these through actions –Do the reward systems reinforce the controls?

• eg NAB case (week 10) –Do management do as they say?

• eg Johnson and Johnson (week 3)?

• Belief systems are slanted towards Clan cultures

Australian School of Business

Levers of Control - Boundary Systems

• Unlike the prior systems these are negative systems and are like the brakes in a car – Tend to focus on standards of ethical behaviour – Critical for firms where reputation and trust are key competitive

advantages • eg consulting firms and financial institutions

• Establish a clear strategy – Identify what actions may de-rail this strategy – Declare this off-limits

• Aimed at protection of reputation – eg the Nike case? What of the actions in Maytag?

• Boundary systems are slanted towards Market cultures

Australian School of Business Levers of Control - Interactive Control Systems

• These are in essence sensing systems to identify what is happening throughout the organisation

• Characteristics – Focused on constantly changing information – Information requires regular attention – Data best interpreted via meetings – Promotes ongoing debate about the data

• What was the extent of interaction between various contractors in the BP case?

• Interactive control systems are slanted towards Fief cultures

Australian School of Business

How Organisations Process Risk

Hierarchy Market Clan Fief

Values Organisation’s Goals

Own Goals

Shared Goals

Accept Goals

Risk Avoider Seeker Averse Ignore

Control Administrative (Diagnostic)

Contract (Boundary)

Communal (Belief)

Subsumptive (Interactive)

Australian School of Business

The Risk Calculator

• Simons argues that risks build up in times or growth, the good times – During this time controls tend to become lax and

management overconfident

• In order to counteract this build up in risks, Simon’s argues that the organisation must enhance controls in two broad areas by: – Establishing and maintaining a strong risk aware culture – Establishing and maintaining a strong information

management environment

• These factors led Simon to develop his “Risk Calculator”

Australian School of Business

Inexperience of key

employees

Rate of Expansion

Pressure for Performance

Rewards for Entrepreneurial

Risk Taking

Executive resistance

to bad news

Level of internal

competition

Transaction complexity and velocity

Gaps in diagnostic

performance measures

Degree of decentralised

decision-making

Growth

Culture

Information Management

Simon’s Risk Calculator