1701 i Fundamentals of Risk Management ii THIS PAGE IS INTENTIONALLY LEFT BLANK iii Fundamentals of Risk Management Understanding, evaluating and implementing effective risk management Paul Hopkin iv Publisher’s note Every possible effort has been made to ensure that the information contained in this book is accurate at the time of going to press, and the publishers and authors cannot accept responsibility for any errors or omissions, however caused. No responsibility for loss or damage occasioned to any person acting, or refraining from action, as a result of the material in this publication can be accepted by the editor, the publisher or any of the authors. First published in Great Britain and the United States in 2010 by Kogan Page Limited. Apart from any fair dealing for the purposes of research or private study, or criticism or review, as per- mitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored or transmitted, in any form or by any means, with the prior permission in writing of the publish- ers, or in the case of reprographic reproduction in accordance with the terms and licences issued by the CLA.
Enquiries concerning reproduction outside these terms should be sent to the publishers at the undermentioned addresses: 120 Pentonville Road 525 South 4th Street, #241 4737/23 Ansari Road London N1 9JN Philadelphia PA 19147 Daryaganj United Kingdom USA New Delhi 110002 www.com India © The Institute of Risk Management, 2010 The right of The Institute of Risk Management to be identified as the author of this work has been asserted by them in accordance with the Copyright, Designs and Patents Act 1988. ISBN 978 0 7494 5942 0 E-ISBN 978 0 7494 5943 7 British Library Cataloguing-in-Publication Data A CIP record for this book is available from the British Library. Library of Congress Cataloging-in-Publication Data Hopkin, Paul. Fundamentals of risk management : understanding, evaluating, and implementing effective risk man- agement / Paul Hopkin.15'5--dc22 2009046006 Typeset by Saxon Graphics Ltd, Derby Printed and bound in India by Replika Press Pvt Ltd v Dedication Michael, David and Kathy vi THIS PAGE IS INTENTIONALLY LEFT BLANK vii Contents Dedication v List of Figures xvii List of Tables xix Preface xxiii Acknowledgements xxv Introduction 1 Part 1 Introduction to risk management 9 Learning outcomes for Part 1 9 Part 1 Further reading 10 1 Approaches to defining risk 11 Definitions of risk 11 Types of risks 13 Risk description 14 Inherent level of risk 16 Risk classification systems 16 Risk likelihood and magnitude 17 2 Impact of risk on organizations 20 Risk importance 20 Impact of hazard risks 21 Attachment of risks 22 Risk and reward 23 Risk and uncertainty 25 Attitudes to risk 26 viii Contents 3 Types of risks 28 Timescale of risk impact 28 Hazard, control and opportunity risks 29 Hazard tolerance 31 Management of hazard risks 32 Uncertainty acceptance 33 Opportunity investment 34 4 Development of risk management 36 Origins of risk management 36 Insurance origins of risk management 40 Specialist areas of risk management 41 Enterprise risk management 42 Levels of risk management sophistication 43 Risk maturity models 45 5 Principles and aims of risk management 46 Principles of risk management 46 Importance of risk management 47 Risk management activities 48 Efficient, effective and efficacious 49 Perspectives of risk management 50 Implementing risk management 52 6 Risk management standards 53 Scope of risk management standards 53 Risk management process 56 Risk management framework 56 COSO ERM cube 58 Features of RM standards 59 Control environment approach 62 Case study: Barclays Bank – risk management objectives 63 Part 2 Risk strategy 65 Learning outcomes for Part 2 65 Part 2 Further reading 66 Contents ix 7 Risk management policy 67 Risk architecture, strategy and protocols 67 Risk management policy 69 Risk management architecture 72 Risk management strategy 72 Risk management protocols 73 Risk management guidelines 74 8 Risk management documentation 76 Record of risk management activities 76 Risk response and improvement plans 77 Event reports and recommendations 78 Risk performance and certification reports 79 Designing a risk register 79 Using a risk register 83 9 Risk management responsibilities 87 Allocation of responsibilities 87 Risk management and internal audit 88 Range of responsibilities 88 Statutory responsibilities of management 90 Role of the risk manager 92 Chief risk officer (CRO) 93 10 Risk architecture and structure 95 Risk architecture 95 Corporate structure 97 Risk committees 98 Risk communications 100 Risk maturity 101 Alignment of activities 103 11 Risk-aware culture 104 Styles of risk management 104 Defining risk culture 105 Components of a risk-aware culture 106 Measuring risk culture 107 x Contents Risk culture and risk strategy 108 Establishing the context 108 12 Risk training and communication 110 Risk training and risk culture 110 Risk information and communication 111 Shared risk vocabulary 112 Risk information on an intranet 113 Risk management information systems (RMIS) 113 Consistent response to risk 115 Case study: Tesco – risk management responsibilities 117 Part 3 Risk assessment 119 Learning outcomes for Part 3 119 Part 3 Further reading 120 13 Risk assessment considerations 121 Importance of risk assessment 121 Approaches to risk assessment 122 Risk assessment techniques 123 Risk matrix 125 Risk perception 126 Risk appetite 127 14 Risk classification systems 131 Short, medium and long-term risks 131 Purpose of risk classification systems 132 Examples of risk classification systems 132 FIRM risk scorecard 134 PESTLE risk classification system 135 Hazard, control and opportunity risks 137 15 Risk likelihood and impact 140 Application of a risk matrix 140 Inherent and current level of risk 141 Control confidence 143 Contents xi 4Ts of risk response 143 Risk significance 144 Risk capacity 146 16 Loss control 148 Risk likelihood 148 Risk magnitude 149 Hazard risks 150 Loss prevention 151 Damage limitation 152 Cost containment 152 17 Defining the upside of risk 154 Upside of risk 154 Opportunity assessment 156 Riskiness index 157 Upside in strategy 160 Upside in projects 161 Upside in operations 162 18 Business continuity planning 163 Importance of BCP and DRP 163 Business continuity standards 164 Successful BCP and DRP 166 Business impact analysis (BIA) 168 BCP and ERM 168 Civil emergencies 169 Case study: Invensys – risks and uncertainties 171 Part 4 Risk and organizations 173 Learning outcomes for Part 4 173 Part 4 Further reading 174 19 Corporate governance model 175 Corporate governance 175 OECD principles of corporate governance 176 xii Contents LSE corporate governance framework 177 Corporate governance for a bank 179 Corporate governance for a government agency 180 Evaluation of board performance 182 20 Stakeholder expectations 185 Range of stakeholders 185 Stakeholder dialogue 186 Stakeholders and core processes 188 Stakeholders and strategy 189 Stakeholders and tactics 189 Stakeholders and operations 190 21 Analysis of the business model 192 Simplified business model 192 Core business processes 193 Efficacious strategy 194 Effective processes 195 Efficient operations 196 Reporting performance 196 22 Project risk management 198 Introduction to project risk management 198 Development of project risk management 199 Uncertainty in projects 200 Project life cycle 200 Opportunity in projects 202 Project risk analysis and management 202 23 Operational risk management 205 Operational risk 205 Definition of operational risk 206 Basel II 207 Measurement of operational risk 208 Difficulties of measurement 210 Developments in operational risk 212 Contents xiii 24 Supply chain management 214 Importance of the supply chain 214 Scope of the supply chain 215 Strategic partnerships 216 Joint ventures 217 Outsourcing of operations 217 Risk and contracts 219 Case study: Hercules Incorporated – outsourcing logistics 221 Part 5 Risk response 223 Learning outcomes for Part 5 223 Part 5 Further reading 224 25 Enterprise risk management 225 Enterprise-wide approach 225 Definitions of ERM 226 ERM in practice 227 ERM and business continuity 229 ERM in energy and finance 229 Future development of ERM 231 26 Importance of risk appetite 233 Risk capacity 233 Risk exposure 235 Nature of risk appetite 236 Cost of risk controls 239 Risk management and uncertainty 240 Risk appetite and lifestyle decisions 242 27 Tolerate, treat, transfer and terminate 244 The 4Ts of hazard response 244 Risk tolerance 248 Risk treatment 248 Risk transfer 249 Risk termination 250 Project and strategic risk response 250 xiv Contents 28 Risk control techniques 253 Hazard risk zones 253 Types of controls 254 Preventive controls 257 Corrective controls 258 Directive controls 258 Detective controls 259 29 Control of selected hazard risks 261 Risk control 261 Control of financial risks 262 Control of infrastructure risks 265 Control of reputational risks 270 Control of marketplace risks 272 Learning from controls 273 30 Insurance and risk transfer 277 Importance of insurance 277 History of insurance 278 Types of insurance cover 279 Evaluation of insurance needs 281 Purchase of insurance 282 Captive insurance companies 284 Case study: Intercontinental Hotels Group – loss-control strategy 287 Part 6 Risk assurance and reporting 289 Learning outcomes for Part 6 289 Part 6 Further reading 290 31 Evaluation of the control environment 291 Nature of internal control 291 Purpose of internal control 292 Control environment 293 Features of the control environment 295 CoCo framework of internal control 296 Risk-aware culture 298 Contents xv 32 Activities of the internal audit function 299 Scope of internal audit 299 Financial assertions 299 Risk management and internal audit 300 Risk management outputs 302 Role of internal audit 302 Management responsibilities 304 33 Risk assurance techniques 306 Audit committees 306 Role of risk management 308 Risk assurance 309 Hazard, control and opportunity risks 310 Control risk self-assessment 311 Benefits of risk assurance 312 34 Reporting on risk management 313 Risk documentation 313 Sarbanes–Oxley Act of 2002 314 Risk reports by US companies 315 Charities risk reporting 317 Public sector risk reporting 318 Government Report on National Security 320 35 Corporate social responsibility 321 CSR and corporate governance 321 CSR and risk management 322 CSR and reputational risk 323 CSR and stakeholder expectations 323 Supply chain and ethical trading 324 CSR reporting 326 36 Future of risk management 327 Review of benefits of risk management 327 Steps to successful risk management 328 Changing face of risk management 331 Concept of risk appetite 332 xvi Contents Concept of upside of risk 333 Future developments 334 Case study: BP – risk reporting 336 Appendix A: Glossary of terms 338 Appendix B: Implementation guide 348 Index 351 xvii Figures 1.1 Risk likelihood and magnitude 18 2.1 Attachment of risks 22 2.2 Risk and reward 24 4.1 7Rs and 4Ts of (hazard) risk management 40 4.2 Risk management sophistication 44 6.1 IRM risk management process 55 6.2 Components of an RM framework 57 6.3 COSO ERM framework 58 6.4 Risk management framework from BS 31100 60 6.5 Risk management process from ISO 31000 61 10.1 RM architecture for a large corporation 96 10.2 RM architecture for a charity 97 13.1 Risk appetite matrix (risk averse) 128 13.2 Risk appetite matrix (risk aggressive) 128 15.1 Personal risk matrix 140 15.2 Risk matrix and the 4Ts of hazard management 141 15.3 Inherent, current and target levels of risk 142 18.1 Model for business continuity planning 165 19.1 Corporate governance framework 178 19.2 Corporate governance in a government agency 180 20.1 Importance of core processes 188 21.1 Simplified business model 193 22.1 Project life cycle 201 26.1 Risk and uncertainty 234 26.2 Risk appetite, exposure and capacity (optimal) 237 26.3 Risk appetite, exposure and capacity (vulnerable) 238 xviii Figures 26.4 Illustration of control effect 239 26.5 Risk management and uncertainty 241 27.1 Types of controls for hazard risks 246 27.2 Risk versus uncertainty in projects 251 27.3 Risk versus reward in strategy 252 28.1 Hazard risk zones 254 29.1 Cost-effective controls 262 29.2 Cost–benefit analysis 274 29.3 Learning from controls 275 29.4 Risk and reward decisions 276 30.1 Role of captive insurance companies 285 31.1 Criteria of Control (CoCo) framework 293 32.1 Role of internal audit in ERM 303 xix Tables 1.1 Definitions of risk 12 1.1 Categories of disruption 31 4.1 Definitions of risk management 37 4.2 Importance of risk management 38 4.