ACCA P1 Governance, Risk and Ethics - 2010 - Study text

Подождите немного. Документ загружается.

Chapter 10: Identifying and assessing risk

significance of existing risks. Are they giving too much attention to risks that are

no longer significant? Or have they ignored the growth in significance of any

risk that has existed for a long time, but is now much more significant than it

used to be.

Example

The table below compares the significant risks facing a commercial bank, an

international oil company and a large retailing organisation. These are the significant

risks identified by three major listed companies (in the UK) in their annual report

and accounts. All three companies have extensive business interests both outside

and inside the UK.

Commercial bank Retailing organisation Oil company

Strategy risk. The risk of

choosing strategies that do not

maximise shareholder value.

Business strategy risk. Risk

that the business strategy

might take the company in the

wrong direction, or is not

efficiently communicated.

Market risk, especially risk of

changes in the price of oil and

natural gas.

Product-service risk. The risk of

developing products and

services for customers that do

not meet customer

requirements and are worse

than the products or services

offered by competitors.

Financial strategy and group

treasury risk. This covers the

risk of not having available

funds, credit risk, interest rate

risk and currency risk.

Exploration risk. The risk of

being unable to find sufficient

new reserves of oil and natural

gas.

Credit risk.

Risk of under-performance in

the UK business. This is

dependent largely on economic

conditions in the UK.

Reputation risk

Market risk. This includes the

risk from variations in interest

rates (interest rate risk) and

currency exchange rates

(currency risk) as well as the

risk of changes in market

prices of financial products

such as shares.

Competition risk. This is the

risk of losses due to the

activities and successes of

competitors.

Security risk (risk from crime,

civil wars and terrorism).

Environmental risk. The risk

from climate change.

Economic risk. Risk from

changes in the state of national

economies and the world

economy.

Operational risks. Risks of

losses due to human error or

fraud, failures in systems (such

as IT systems) and unforeseen

external events (terrorism

attacks, natural disasters).

People capabilities risk. This is

the risk of failing to attract ‘the

best people’ to work for the

company.

Competition risk

Political risk. This is the risk of

doing business in politically

unstable countries or politically

sensitive countries.

People capabilities risk. This is

the risk of failing to attract ‘the

best people’ to work for the

company.

Reputation risk. Failure to

protect reputation could lead to

a loss of trust and confidence

by customers.

Natural disaster risk

Risk of inadequate liquidity and

inadequate capital.

Environmental risk. Risks arise

from issues such as energy

savings, transport efficiency,

waste management and the

recycling of waste.

Currency risk

IT failures risk

Paper P1: Professional accountant

226 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

Regulatory risk. Product safety risk Regulatory risk

Ethical risks in the supply

chain. This is the risk to

reputation of dealing with

suppliers who do not use

ethical business practices.

Shortage of skilled labour risk,

especially a shortage of

science graduates.

Fraud and compliance risk

IT systems risk. This is the risk

of a failure in the company’s

major IT systems.

Political risk and terrorism risk

Pensions risk. The risk to the

company from the costs of

meeting its liabilities to the

company’s pension scheme for

its employees.

Chapter 10: Identifying and assessing risk

Concepts in risk management

 Exposure to risk

 Residual risk

 Risk appetite

 A risk-based approach

3 Concepts in risk management

To understand risk management, it is necessary to understand a few key concepts.

3.1 Exposure to risk

When a company is exposed to risk, this means that it will suffer a loss if there are

unfavourable changes in conditions in the future or unfavourable events occur. For

example, if a UK company holds US$2 million it is exposed to a risk of a fall in the

value of the dollar against sterling, because the sterling value of the dollars will fall.

Companies need to assess the significance of their exposures to risk. If possible,

exposures should be measured and quantified.

 If a UK company holds US$2 million, its exposure to a fall in the value of the

dollar against sterling is $2 million.

 If an investor holds £100 million in shares of UK listed companies, it has a £100

million exposure to a fall in the UK stock market.

 If a company is owed £500,000 by its customers, its exposure to credit risk is

£500,000.

An exposure is not necessarily the amount that the company will expect to lose if

events or conditions turn out unfavourable. For example, an investor holding £100

million in shares of UK listed companies is exposed to a fall in the market price of

the shares, but he would not expect to lose the entire £100 million. Similarly a

company with receivables of £500,000 should not expect all its receivables to become

bad debts (unless the money is owed by just one or two customers).

Having measured an exposure to risk, a company can estimate what the possible

losses might be, realistically. This estimate of the possible losses should help

management to assess the significance of the risk.

Some risk exposures cannot be measured, because they are ‘qualitative risks’. It is

very difficult, for example, to estimate the possible losses that could arise from

damage to a company’s reputation. Qualitative risks must also be assessed, but

since the amount of the exposure and the possible losses that might occur cannot be

quantified, an assessment of these risks depends on management judgement and

opinion.

Paper P1: Professional accountant

228 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

3.2 Residual risk

Companies control the risks that they face. Controls cannot eliminate risks

completely, and even after taking suitable control measures to control a risk, there is

some remaining risk exposure.

The remaining exposure to a risk after control measures have been taken is called

residual risk. If a residual risk is too high for a company to accept, it should

implement additional control measures to reduce the residual risk to an acceptable

level.

3.3 Risk appetite

A company must accept some risk in order to make profits. This means that a risk of

making a loss must be accepted in order to create a chance to make profit. A

company will take the risk if its management decides that the risk of loss is justified

by the expectation of a gain.

Risk appetite is concerned with how much risk management are willing to take.

Management might be willing to accept the risk of loss up to a certain maximum

limit if the chance of making profits is sufficiently attractive to them. For a market

trader in the financial markets, risk appetite has been defined as ‘the amount of

capital that a trader is willing to lose in order to generate a potential profit.’

Risk appetite is used to describe how willing a board is to take on risk – on a scale

from willing to take on risk through willing to take some risks down to aversion to

taking a risk.

A Board of directors might also have an appetite for one type of risk but an aversion

to a different type of risk. The risk appetite of a Board or management in any

particular situation will depend on:

 the importance of the decision and the nature of the decision

 the amount and nature of the potential gains or losses, and

 the reliability of the information available to help the Board or management to

make their decision.

Board policy on risk

The risk appetite of a company should be decided by the board of directors, and a

policy on risk should be decided and communicated by the board to its

management. Managers need guidance on the levels of risk that it would be

‘legitimate’ for them to take on with any decision that they make.

 Managers should not be allowed to take whatever decisions they consider to be

suitable, regardless of risk. This would lead to inconsistent decision-making and

could expose the company to unacceptable risks. ‘Erratic, inopportune risk-

taking is an accident waiting to happen’ (HM Treasury).

 At the other extreme, a risk averse culture is undesirable, in which managers are

discouraged from taking any risky decisions, so that business opportunities are

not exploited.

Chapter 10: Identifying and assessing risk

3.4 A risk-based approach

The term ‘risk-based approach’ is often used to describe risk management processes.

It is an approach to decision-making based on a detailed evaluation of risks and

exposures, and policy guidelines on the level of risk that is acceptable (risk

appetite).

The risk-based approach takes the view that some risk must be accepted, but risk

exposures should be kept within acceptable limits. Decisions should therefore be

based on a consideration of both expected benefit and the risk.

Example

A company might use discounted cash flow to evaluate capital expenditures. If risk

is ignored, the company might have a standard rule that capital investment projects

should be undertaken if they are expected to have a positive net present value (NPV)

when the forecast cash flows are discounted at the company’s cost of capital.

With a risk-based approach, capital investment projects should not be undertaken

unless their NPV is positive and the level of risk is acceptable.

Example

A risk-based approach can also be compared with a ‘box-ticking’ approach. With a

box-ticking approach, certain procedures must be carried out every time an item is

processed. For example, the customs and immigration department at a country’s

airports might have a policy of checking the baggage of every passenger arriving in

the country by aeroplane, because the policy objective is to eliminate smuggling of

prohibited goods into the country by individuals. This would be a ‘box-ticking’

approach, with standard procedures for every passenger.

With a risk-based approach, the department will take the view that some risk of

smuggled goods entering the country is unavoidable. The policy should therefore be

to try to limit the risk to a certain level. Instead of checking the baggage of every

passenger arriving in the country, customs officials should select passengers whose

baggage they wish to search. Their selection of customers for searching should be

based on a risk assessment – for example what type of customer is most likely to try

to smuggle goods into the country?

Paper P1: Professional accountant

230 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

Identification, assessment and measurement of risk

 Risk identification

 The impact of risk on stakeholders

 Assessing risks: impact and probability

 Measuring risks

 Prioritising risks

 Role of the board of directors in identifying and assessing risks

4 Identification, assessment and measurement of risk

4.1 Risk identification

Risk identification is the initial stage in a system of risk management. A company

needs to understand what risks it faces, both in its environment and markets

(strategic risks) and internally (operational risks).

There are no standard rules about how risks should be identified.

 In a large company, it might be appropriate to identify risks at different levels in

the organisation – on a group-wide basis, and for each business division and for

each department or function.

 Management might be responsible for identifying strategic risks/business risks

for the company, but the internal auditors or external auditors might be more

efficient at identifying operational risks (and suggesting suitable internal

controls to control the risks).

Many large companies set up risk committees to identify risks. These are

committees of managers from several departments or functions. Each committee is

responsible for reporting on a particular category of risk or risks in a particular

geographical area of the company’s operations. A committee meets regularly to

discuss risks and their potential significance, and changes in these risks.

Risks identified by a company will vary in importance. Some risks might be

unimportant, or easily controlled. Some risks will be very significant. Having

identified risks, it is therefore necessary to assess the importance of each risk, in

order to:

 rank the risks in order of significance (order of priority), and

 identify the risks that are the most significant, and

 identify the significant the risks where control measures are urgently needed.

(Deciding on suitable control measures will depend on the significance of the risk,

and the cost of taking control measures. Control measures are only justified if the

cost of the control measures is less than the benefits obtained from reducing the

risk.)

Chapter 10: Identifying and assessing risk

4.2 The impact of risk on stakeholders

The process of identifying risks should concentrate on risks to the company, both

strategic risks and operational risks. However, the risks for a company also create

risks for its stakeholders. Management should be aware of the impact of the

company’s risks on stakeholders, because the risks for stakeholders could affect the

attitude and the behaviour of stakeholders towards to the company.

The impact of a company’s risks on risks for stakeholders varies and depends on

circumstances.

Employees

Employees are exposed to several risks in their job. These include the risk of a loss

of job, and the threat to health or safety in the work that they do. Employment

benefits might be threatened. These risks to employees can be affected by risks that

face their company.

 Jobs may be threatened by the strategic choices taken by a company. If a

company makes the wrong strategic decisions, and the company loses money,

many employees could lose their jobs.

 Safety risks for a company might be measured in terms of the risk of serious

injuries and minor injuries to employees over a given period of time. (For

example, a company might assess its current safety measures in terms of the

expected number of serious injuries per 1,000 employees per year.)

The risk appetite of some employees might differ from the risk appetite of the

company and the board’s policy on risk. For example, a ‘rogue trader’ working in

the financial markets for a bank might be willing to take high risks for the company

because the potential benefits for him personally (a large cash bonus for making

large trading profits) exceeds the risk (the possible loss of his job).

Investors

When investors buy the shares of a company, they have some expectation of the sort

of company it is and the returns they might expect from their investment. For

example, an investor might buy shares in a company expecting it to be a high-risk

company which could achieve a very high rate of growth in the share price. Or an

investor might buy shares in a company because the company is stable and can be

expected to pay a regular annual dividend.

The board of directors should try to ensure that the risk appetite of the company is

consistent with the risk appetite of its shareholders (and other stock market

investors). A company should not expose itself to strategic risks that expose the

investors to a risk to their investment that the shareholders would consider

excessive.

 When a company increases its exposures to strategic risk, many existing

shareholders might decide to sell their shares and switch to investing in a lower-

risk company. Investors with a larger risk appetite might buy the shares.

 The board of directors should keep shareholders informed about the significant

risks that the company faces, so that investors can assess their own investment

risk. (In the UK, for example, stock market companies are now required by law

Paper P1: Professional accountant

to include disclosures about risks in their annual narrative report to

shareholders, the business review.)

Creditors

The main risks to a company’s creditors and suppliers from the company’s own

risks are that:

 the company will not pay what they owe, and

 the company will stop buying goods and services from them.

A high-risk company is a high credit risk. The liquidity risk and insolvency risk

facing a company has an impact on the credit risk for a supplier or lender. When a

company asks a bank for a loan, the bank will assess the credit status of the

company, and it will make its decision to lend on the basis of whether it thinks that

the company will be able to pay back the loan with interest and on schedule.

Communities and the general public

Communities and the general public are exposed to risks from the actions of

companies, and the failure by companies to control their risks.

 Risks to the general public include:

- the consequences for the country of a decline in the business activities and

profits of a company due to recession, especially when the company is a

major employer

- health and safety risks from failures by a company to supply goods that meet

with health and safety standards

- risks to the quality of life from environmental pollution, due to a failure by

the company to control its environmental/pollution risks.

 Risks to a local community also arise from economic risks faced by the company.

If a company is forced to close down a production plant in an area where it is a

major employer, the economy of the entire community would be affected.

Pressure groups and popular action groups come into existence because ‘activist’

members of the general public believe that their well-being is threatened. The cause

of the perceived threat is often the activities of companies.

Some companies take risk-based decisions that expose them to considerable

strategic risk without necessarily considering fully the risk impact on the general

public or local communities. For example, an energy company planning to construct

a new nuclear power station should consider the long-term risks to the community –

and the general public – not just their own business risks relating to costs.

Governments

For governments, companies are a source of economic wealth for the country. They

create additional economic activity which creates extra wealth, and they provide

employment and tax revenues for the government.

Chapter 10: Identifying and assessing risk

A risk for government is that major companies will decide to invest in a different

country, or move its operations from one country to another.

For example, manufacturing companies in the European Union have been faced

with the risk of low-cost competition from suppliers in the Far East, where labour

costs in some countries are much lower than in Europe. To overcome this threat,

companies might consider relocating their manufacturing operations to the Far East.

The strategic threat to these companies has an obvious impact on the governments

of European Union countries, because the economies of those countries would be

affected by a loss of manufacturing businesses.

Customers

Some risks facing companies also have an impact on their customers.

 A company might face operational risks from human error or system breakdown

in its operations. Errors and delays in providing goods and services have an

impact on business customers. For example, if a company is late in supplying a

key component to a business customer, the customer will be late in supplying its

own customers. Errors and delays work their way through the entire supply

chain.

 Product safety risks for a company are also a risk for customers who use them.

For example, manufacturers of foods products, drink products and medicines

and drugs need to consider the potential risk to customers from weaknesses in

their own safety controls.

Business partners

There are risks in joint ventures for all the joint venture partners. A company in a

joint venture might try to dominate decision-making in order to reduce the risk that

the joint venture will not operate in the way that they want it to.

However, by reducing its exposures to risk in a joint venture, a company will affect

the risks for the other joint venture partners.

Risks in partnerships can be controlled for all the partners – to some extent – by

clear terms in the contract agreement between the partners, and by monitoring

performance of the partnership.

A UK public company (with several joint ventures in other countries) has

commented on joint venture governance and partnerships as follows: ‘As we

continue to enter into new partnerships and grow existing joint ventures, the risk

inherent in managing these partnerships increases. It is more difficult to guarantee

the achievement of joint goals and we rely on partners’ reputations. We choose

partners with good reputations and set out joint goals and clear contractual

arrangements from the outset. We monitor performance and governance of our joint

ventures and partnerships.’

Paper P1: Professional accountant

4.3 Assessing risks: impact and probability

The assessment of risk is sometimes called ‘risk profiling’ or ‘risk mapping’.

To assess each risk, it is necessary to consider the likelihood that losses will occur as

a consequence of the risk, and the size or amount of the loss when this happens.

A simple approach to risk mapping involves taking each risk that has been

identified and placing it on a map. The map is a 2 × 2 matrix, with:

 one side representing the frequency of adverse events or the probability that the

risk will materialise and an adverse outcome will occur, and

 the other side representing the impact (loss) if an adverse event occurs or

adverse circumstances arise.

The format of a simple risk map is shown below.

High impact

Low probability

Consider the need for

control measures, such

as insurance

High impact

High probability

Take immediate action to

control the risk

Impact/size of

potential loss

Low impact

Low probability

Review periodically

Low impact

High probability

Consider the need for

control action

Low probability/

frequency

High probability/

Frequency

Probability or frequency of the risk materialising

A risk map can help management to identify risks where immediate control

measures are required, and where the need for control measures should be

considered or reviewed periodically.

‘High impact, low probability’ risks might include the risks of damage to assets

from fire or flooding, the risk of a terrorist attack or the risk of major legislation that

will affect the company’s business. Some of these risks, such as risks of fire, theft

and criminal damage, can be insured. Insurance reduces the residual risk by the

amount of the insurance cover obtained.

All key risks should be ‘owned’ by specific individual managers, who should be

required to take the necessary control measures and report to their senior manager

about what they have done.

ACCA P1 Governance, Risk and Ethics - 2010 - Study text - Emile Woolf Publishing

Подождите немного. Документ загружается.