Risk Management

Enterprise Risk Management (ERM) is the process by which an organisation identifies, assesses, manages, and monitors risks across the entire enterprise in a coordinated, structured way. The goal is to manage the portfolio of risks within the organisation's risk appetite.

The COSO ERM Framework (Committee of Sponsoring Organizations, updated 2017) integrates ERM with strategy and performance. It consists of five interrelated components and 20 principles:

1. Governance and culture: The board provides oversight of ERM. Management establishes operating structures. The organisation defines desired culture, demonstrates commitment to core values, and attracts/develops/retains capable individuals.
2. Strategy and objective-setting: ERM is integrated into the strategic planning process. The organisation analyses the business context, defines risk appetite, evaluates alternative strategies, and formulates business objectives that align with strategy and risk appetite.
3. Performance: The organisation identifies and assesses risks that may affect the achievement of objectives, prioritises risks based on severity (impact × likelihood), implements risk responses, and develops a portfolio view of risk.
4. Review and revision: The organisation reviews entity performance and considers how well ERM components are functioning. It pursues improvement of ERM and reviews risk and performance on an ongoing basis.
5. Information, communication, and reporting: The organisation leverages information systems to support ERM, communicates risk information across the entity, and reports on risk, culture, and performance to the board and stakeholders.

Risk appetite and risk tolerance:

• Risk appetite: The broad level of risk an organisation is willing to accept in pursuit of its strategic objectives. Set by the board. Expressed qualitatively ("conservative," "moderate," "aggressive") or quantitatively (e.g., "willing to accept a maximum 5% probability of losses exceeding £10m in any year").
• Risk tolerance: The acceptable variation in performance relative to a specific objective. More granular than risk appetite — applied at the operational level. Example: "revenue forecast variance of ±5% is tolerable."
• Risk culture: The shared values, beliefs, and attitudes toward risk within the organisation. A strong risk culture means employees at all levels understand their role in managing risk, feel empowered to raise concerns, and make decisions consistent with the risk appetite.

Risk identification is the process of finding, recognising, and describing risks that could affect the achievement of objectives.

Methods of identification:

• Brainstorming and workshops with management and operational staff
• PESTEL and Five Forces analysis (external risks)
• SWOT analysis (internal weaknesses and external threats)
• Process mapping and value chain analysis (operational risks)
• Historical analysis — reviewing past incidents, losses, and near-misses
• Scenario planning — "what if" analysis of plausible future events
• Internal audit findings and external audit management letters
• Industry benchmarking — what risks are peers facing?

Risk register: A documented record of all identified risks, typically containing:

• Risk description and category (operational, strategic, financial, etc.)
• Risk owner (the person responsible for managing the risk)
• Likelihood and impact assessment (before and after controls)
• Existing controls (mitigations already in place)
• Residual risk rating (risk remaining after existing controls)
• Planned further actions and timeline
• Status and review date

Risk matrix (heat map): A visual tool that plots risks on a grid of likelihood (probability of occurrence) × impact (severity of consequences). Typically scored on a scale (e.g., 1-5 for each axis). Risks in the top-right (high likelihood, high impact) are the most critical and require immediate action. Risks in the bottom-left are low priority.

Inherent risk vs residual risk:

• Inherent risk: The risk level BEFORE any controls or mitigations are applied
• Residual risk: The risk level AFTER controls are applied. The board's role is to ensure residual risks are within the risk appetite.

Once risks are assessed, the organisation selects an appropriate response strategy (sometimes called the "4 Ts"):

In practice: Most risks are managed through a combination of responses. For example, a company may reduce cyber risk through firewalls and training (reduce), purchase cyber insurance (transfer), accept residual risk below a threshold (accept), and decide not to store certain sensitive data (avoid).

Strategic risk: Risks arising from the strategic choices the organisation makes — entering the wrong market, choosing the wrong product, being disrupted by new technology, misreading competitor moves, M&A failure. Strategic risks are often the most significant because they affect the organisation's long-term viability.

Operational risk: Risks arising from the day-to-day operations — process failures, system outages, supply chain disruption, human error, fraud, health and safety incidents, quality failures, capacity constraints. Managed through internal controls, process improvement, and contingency planning.

Financial risk:

• Currency (foreign exchange) risk: The risk that changes in exchange rates will adversely affect the value of foreign currency transactions, assets, or liabilities. Three types: transaction risk (impact on individual transactions — e.g., a receivable in USD may be worth less when converted to GBP), translation risk (impact on consolidation of foreign subsidiary results), economic risk (long-term competitiveness affected by exchange rate trends).
• Interest rate risk: The risk that changes in interest rates will increase borrowing costs or reduce investment returns. Variable rate debt → higher interest payments if rates rise. Fixed rate debt → opportunity cost if rates fall. Managed through: interest rate swaps, caps, collars, and FRAs.
• Credit risk: The risk that a counterparty will fail to meet its financial obligations — customer non-payment, counterparty default on a derivative contract. Managed through: credit checks, credit limits, credit insurance, diversification of customers/counterparties, collateral requirements.
• Liquidity risk: The risk that the organisation cannot meet its short-term financial obligations — insufficient cash flow, inability to convert assets to cash quickly, loss of credit facilities.

Reputational risk: The risk of damage to the organisation's reputation — from poor customer service, product failures, data breaches, ethical scandals, environmental incidents, executive misconduct. Reputational damage can be catastrophic: loss of customers, difficulty attracting talent, share price decline, regulatory scrutiny. Often a secondary consequence of other risk events.

Cyber risk: The risk of financial loss, disruption, or reputational damage from failures in IT systems, data breaches, ransomware attacks, or cyber-espionage. Increasingly significant due to digital transformation and the value of data. Managed through: cybersecurity controls (firewalls, encryption, access management, patching), employee training (phishing awareness), incident response plans, cyber insurance, and regular penetration testing.

Business continuity planning (BCP) ensures that critical business functions can continue or be rapidly restored following a disruptive event — natural disaster, fire, flood, cyber attack, pandemic, supply chain failure, or major system outage.

Key elements of a BCP:

1. Business impact analysis (BIA): Identify critical business processes and the impact of their disruption. Determine the recovery time objective (RTO) — the maximum acceptable time before a process must be restored — and the recovery point objective (RPO) — the maximum acceptable data loss (measured in time).
2. Risk assessment: Identify the threats most likely to cause disruption and their potential impact (using the risk matrix).
3. Continuity strategies: Develop strategies to maintain or restore critical functions — alternative work locations (hot/warm/cold sites), backup systems and data recovery, alternative suppliers, manual workarounds, remote working capability.
4. Plan documentation: A written plan detailing: responsibilities, contact lists (crisis team, key personnel, suppliers, regulators), activation procedures, recovery procedures, communication plan (employees, customers, media).
5. Testing and exercising: Regular testing of the plan — tabletop exercises (walk-through discussion), simulation exercises (realistic scenario), full interruption tests. Identify weaknesses and update the plan.
6. Maintenance and review: The plan must be kept current — reviewed at least annually and after any major organisational change, incident, or test. Assign a plan owner.

Disaster recovery (DR): A subset of BCP focused specifically on the recovery of IT systems and data after a disruptive event. Includes: backup strategies (on-site, off-site, cloud), failover systems, data replication, and IT recovery procedures.