Risk man­age­ment: How to make sound decisions

“Risk man­age­ment” describes all the measures for identi­fy­ing and in­flu­en­cing the op­por­tun­it­ies and threats that arise in the course of business activity. These op­por­tun­it­ies and risks can have a positive or negative impact on the success of the business.

It is not the task of risk man­age­ment to eliminate all threats – because that is prac­tic­ally im­possible. Rather, the goal is to optimise the re­la­tion­ship between op­por­tun­it­ies and risks. In other words, suc­cess­ful risk man­age­ment con­trib­utes to decision-making and planning security, minimises the risk of in­solv­ency, and sta­bil­ises the earnings situation.

Risk man­age­ment not only makes economic sense for companies, it’s also a legally binding building block in corporate man­age­ment. There is a complex legal framework in the UK when it comes to corporate risk and com­pli­ance man­age­ment. Several standards have been developed worldwide to help busi­nesses implement risk man­age­ment ef­fi­ciently. With this common idea of how processes should work, it helps to regulate the practice the world over.

The most important in­ter­na­tion­al standards include the risk man­age­ment standard ISO 31000:2009, the quality man­age­ment standard ISO 9001:2015, and the COSO En­ter­prise Risk Man­age­ment Framework (COSO ERM 2017). The framework, also known as the COSO cube, cat­egor­ises risk man­age­ment according to com­pon­ents, target cat­egor­ies, and or­gan­isa­tion­al units.

The guidelines set out in these standards are intended to help companies implement their own risk man­age­ment and develop it further. Both the ISO and the COSO standards are regularly reviewed and, if necessary, adapted to reflect current de­vel­op­ments in the corporate world.

In addition, the UK also has the “Risk Man­age­ment Standard”, which was developed in 2002 by the UK’s three main risk or­gan­isa­tions.

Fre­quently, risk man­age­ment is linked to com­pli­ance and corporate gov­ernance in companies, because all three dis­cip­lines are closely related to one another. They all con­trib­ute to proper and efficient corporate gov­ernance.

Corporate risk man­age­ment can be divided into strategic and op­er­a­tion­al risk man­age­ment. The strategic aspect involves defining risk man­age­ment ob­ject­ives, for­mu­lat­ing an over­arch­ing strategy, and defining op­er­a­tion­al processes. Im­ple­ment­ing these processes is the task of op­er­a­tion­al risk man­age­ment.

The first step is risk de­term­in­a­tion, which involves sorting, identi­fy­ing, and de­scrib­ing all existing risks qual­it­at­ively, in­di­vidu­ally, and by risk area. This can be done on the company’s level as well as at the project level. Decision-makers can use different methods to structure the iden­ti­fic­a­tion process and ensure that all threats and sources of harm are iden­ti­fied:

• Expert and employee surveys
• Eval­u­ation of existing data and documents
• Internal risk workshops
• Factory and site visits

At the end of this phase, a complete risk catalogue (also: risk inventory) should have been created.

In the next step, each in­di­vidu­al risk is quant­it­at­ively assessed with regard to its prob­ab­il­ity of oc­cur­rence and its potential impact. In the as­sess­ment, not only one risk must be con­sidered in isolation, but also the con­sequences of several risks in­ter­act­ing or ac­cu­mu­lat­ing over time. This aspect is also referred to as risk ag­greg­a­tion.

Prob­ab­il­ity dis­tri­bu­tions or frequency dis­tri­bu­tions are used in quan­ti­fic­a­tion. The concrete measure used to assess a risk is called the “value at risk”.

Steps 1 and 2 are also referred to col­lect­ively as risk analysis. This analysis is con­sidered to be the most difficult step in the risk man­age­ment process, as not only current but also future risks need to be iden­ti­fied and assessed. Once the results of the risk analysis have been evaluated, the risks that have a par­tic­u­larly high prob­ab­il­ity of occurring have priority and should be dealt with first.

Risk man­age­ment involves examining the methods applied with regard to their ef­fi­ciency, ap­pro­pri­ate­ness, and ef­fect­ive­ness. Con­trolling can take place in two ways that ideally com­ple­ment one another: as con­tinu­ous mon­it­or­ing in real time and as periodic in-depth risk as­sess­ment. The results are promptly forwarded to those re­spons­ible.

Risk man­age­ment is not the re­spons­ib­il­ity of one in­di­vidu­al, but concerns every employee in the company. Although the strategy and fun­da­ment­al ori­ent­a­tion of risk man­age­ment are de­term­ined by man­age­ment, other employees are involved in the op­er­a­tion­al business.

The model of the three lines of defence is often used for al­loc­at­ing re­spons­ib­il­it­ies in risk man­age­ment:

• First line: Managers and employees react to op­er­a­tion­al risks in ac­cord­ance with the defined strategies – supported by an internal system of controls.
• Second line: Employees who are directly involved in risk man­age­ment tasks support and monitor the first line, e.g. by spe­cify­ing methods or by coaching.
• Third line: Risk man­age­ment is monitored by an in­de­pend­ent body.

Identi­fy­ing and managing risks is an integral part of our corporate culture. Therefore, risk man­age­ment is not confined to the top floor. However, it affects every single employee in his or her daily work.

Anyone who does not take into account the possible negative effects of their decisions in advance ul­ti­mately endangers the economic stability of a company. With its methods, risk man­age­ment offers the necessary tools to clearly identify risks instead of relying on a vague gut feeling. This makes it possible for companies to take cal­cu­lated risks that are necessary for growth and success.