Fundamentals of Risk Management: Understanding, Evaluating And
Total Page：16
File Type：pdf, Size：1020Kb
i Fundamentals of Risk Management ii THIS PAGE IS INTENTIONALLY LEFT BLANK iii Fundamentals of Risk Management Understanding, evaluating and implementing effective risk management Paul Hopkin iv Publisher’s note Every possible effort has been made to ensure that the information contained in this book is accurate at the time of going to press, and the publishers and authors cannot accept responsibility for any errors or omissions, however caused. No responsibility for loss or damage occasioned to any person acting, or refraining from action, as a result of the material in this publication can be accepted by the editor, the publisher or any of the authors. First published in Great Britain and the United States in 2010 by Kogan Page Limited. Apart from any fair dealing for the purposes of research or private study, or criticism or review, as per- mitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored or transmitted, in any form or by any means, with the prior permission in writing of the publish- ers, or in the case of reprographic reproduction in accordance with the terms and licences issued by the CLA. Enquiries concerning reproduction outside these terms should be sent to the publishers at the undermentioned addresses: 120 Pentonville Road 525 South 4th Street, #241 4737/23 Ansari Road London N1 9JN Philadelphia PA 19147 Daryaganj United Kingdom USA New Delhi 110002 www.koganpage.com India © The Institute of Risk Management, 2010 The right of The Institute of Risk Management to be identifi ed as the author of this work has been asserted by them in accordance with the Copyright, Designs and Patents Act 1988. ISBN 978 0 7494 5942 0 E-ISBN 978 0 7494 5943 7 British Library Cataloguing-in-Publication Data A CIP record for this book is available from the British Library. Library of Congress Cataloging-in-Publication Data Hopkin, Paul. Fundamentals of risk management : understanding, evaluating, and implementing effective risk man- agement / Paul Hopkin. p. cm. Includes index. ISBN 978-0-7494-5942-0 -- ISBN 978-0-7494-5943-7 (ebook) 1. Risk management. I. Title. HD61.H567 2010 658.15'5--dc22 2009046006 Typeset by Saxon Graphics Ltd, Derby Printed and bound in India by Replika Press Pvt Ltd v Dedication Michael, David and Kathy vi THIS PAGE IS INTENTIONALLY LEFT BLANK vii Contents Dedication v List of Figures xvii List of Tables xix Preface xxiii Acknowledgements xxv Introduction 1 Part 1 Introduction to risk management 9 Learning outcomes for Part 1 9 Part 1 Further reading 10 1 Approaches to defi ning risk 11 Defi nitions of risk 11 Types of risks 13 Risk description 14 Inherent level of risk 16 Risk classifi cation systems 16 Risk likelihood and magnitude 17 2 Impact of risk on organizations 20 Risk importance 20 Impact of hazard risks 21 Attachment of risks 22 Risk and reward 23 Risk and uncertainty 25 Attitudes to risk 26 viii Contents 3 Types of risks 28 Timescale of risk impact 28 Hazard, control and opportunity risks 29 Hazard tolerance 31 Management of hazard risks 32 Uncertainty acceptance 33 Opportunity investment 34 4 Development of risk management 36 Origins of risk management 36 Insurance origins of risk management 40 Specialist areas of risk management 41 Enterprise risk management 42 Levels of risk management sophistication 43 Risk maturity models 45 5 Principles and aims of risk management 46 Principles of risk management 46 Importance of risk management 47 Risk management activities 48 Effi cient, effective and effi cacious 49 Perspectives of risk management 50 Implementing risk management 52 6 Risk management standards 53 Scope of risk management standards 53 Risk management process 56 Risk management framework 56 COSO ERM cube 58 Features of RM standards 59 Control environment approach 62 Case study: Barclays Bank – risk management objectives 63 Part 2 Risk strategy 65 Learning outcomes for Part 2 65 Part 2 Further reading 66 Contents ix 7 Risk management policy 67 Risk architecture, strategy and protocols 67 Risk management policy 69 Risk management architecture 72 Risk management strategy 72 Risk management protocols 73 Risk management guidelines 74 8 Risk management documentation 76 Record of risk management activities 76 Risk response and improvement plans 77 Event reports and recommendations 78 Risk performance and certifi cation reports 79 Designing a risk register 79 Using a risk register 83 9 Risk management responsibilities 87 Allocation of responsibilities 87 Risk management and internal audit 88 Range of responsibilities 88 Statutory responsibilities of management 90 Role of the risk manager 92 Chief risk offi cer (CRO) 93 10 Risk architecture and structure 95 Risk architecture 95 Corporate structure 97 Risk committees 98 Risk communications 100 Risk maturity 101 Alignment of activities 103 11 Risk-aware culture 104 Styles of risk management 104 Defi ning risk culture 105 Components of a risk-aware culture 106 Measuring risk culture 107 x Contents Risk culture and risk strategy 108 Establishing the context 108 12 Risk training and communication 110 Risk training and risk culture 110 Risk information and communication 111 Shared risk vocabulary 112 Risk information on an intranet 113 Risk management information systems (RMIS) 113 Consistent response to risk 115 Case study: Tesco – risk management responsibilities 117 Part 3 Risk assessment 119 Learning outcomes for Part 3 119 Part 3 Further reading 120 13 Risk assessment considerations 121 Importance of risk assessment 121 Approaches to risk assessment 122 Risk assessment techniques 123 Risk matrix 125 Risk perception 126 Risk appetite 127 14 Risk classifi cation systems 131 Short, medium and long-term risks 131 Purpose of risk classifi cation systems 132 Examples of risk classifi cation systems 132 FIRM risk scorecard 134 PESTLE risk classifi cation system 135 Hazard, control and opportunity risks 137 15 Risk likelihood and impact 140 Application of a risk matrix 140 Inherent and current level of risk 141 Control confi dence 143 Contents xi 4Ts of risk response 143 Risk signifi cance 144 Risk capacity 146 16 Loss control 148 Risk likelihood 148 Risk magnitude 149 Hazard risks 150 Loss prevention 151 Damage limitation 152 Cost containment 152 17 Defi ning the upside of risk 154 Upside of risk 154 Opportunity assessment 156 Riskiness index 157 Upside in strategy 160 Upside in projects 161 Upside in operations 162 18 Business continuity planning 163 Importance of BCP and DRP 163 Business continuity standards 164 Successful BCP and DRP 166 Business impact analysis (BIA) 168 BCP and ERM 168 Civil emergencies 169 Case study: Invensys – risks and uncertainties 171 Part 4 Risk and organizations 173 Learning outcomes for Part 4 173 Part 4 Further reading 174 19 Corporate governance model 175 Corporate governance 175 OECD principles of corporate governance 176 xii Contents LSE corporate governance framework 177 Corporate governance for a bank 179 Corporate governance for a government agency 180 Evaluation of board performance 182 20 Stakeholder expectations 185 Range of stakeholders 185 Stakeholder dialogue 186 Stakeholders and core processes 188 Stakeholders and strategy 189 Stakeholders and tactics 189 Stakeholders and operations 190 21 Analysis of the business model 192 Simplifi ed business model 192 Core business processes 193 Effi cacious strategy 194 Effective processes 195 Effi cient operations 196 Reporting performance 196 22 Project risk management 198 Introduction to project risk management 198 Development of project risk management 199 Uncertainty in projects 200 Project life cycle 200 Opportunity in projects 202 Project risk analysis and management 202 23 Operational risk management 205 Operational risk 205 Defi nition of operational risk 206 Basel II 207 Measurement of operational risk 208 Diffi culties of measurement 210 Developments in operational risk 212 Contents xiii 24 Supply chain management 214 Importance of the supply chain 214 Scope of the supply chain 215 Strategic partnerships 216 Joint ventures 217 Outsourcing of operations 217 Risk and contracts 219 Case study: Hercules Incorporated – outsourcing logistics 221 Part 5 Risk response 223 Learning outcomes for Part 5 223 Part 5 Further reading 224 25 Enterprise risk management 225 Enterprise-wide approach 225 Defi nitions of ERM 226 ERM in practice 227 ERM and business continuity 229 ERM in energy and fi nance 229 Future development of ERM 231 26 Importance of risk appetite 233 Risk capacity 233 Risk exposure 235 Nature of risk appetite 236 Cost of risk controls 239 Risk management and uncertainty 240 Risk appetite and lifestyle decisions 242 27 Tolerate, treat, transfer and terminate 244 The 4Ts of hazard response 244 Risk tolerance 248 Risk treatment 248 Risk transfer 249 Risk termination 250 Project and strategic risk response 250 xiv Contents 28 Risk control techniques 253 Hazard risk zones 253 Types of controls 254 Preventive controls 257 Corrective controls 258 Directive controls 258 Detective controls 259 29 Control of selected hazard risks 261 Risk control 261 Control of fi nancial risks 262 Control of infrastructure risks 265 Control of reputational risks 270 Control of marketplace risks 272 Learning from controls 273 30 Insurance and risk transfer 277 Importance of insurance 277 History of insurance 278 Types of insurance cover 279 Evaluation of insurance needs 281 Purchase of insurance 282 Captive insurance companies 284 Case study: Intercontinental Hotels Group – loss-control strategy 287 Part 6 Risk assurance and reporting 289 Learning outcomes