Organizations of all kinds operate in uncertain environments with challenging natural, political, socio-economic and cultural influences. These influences may affect their ability to meet their objectives. The uncertain economic situation of the past few years is a clear, real and pragmatic example of the effect of this uncertainty, something known as “risk”.
Risk can be considered in many ways. In business, we often use four main categories: market, credit, operational and reputational risk. These can be examined across the whole organisation, to help understand and evaluate the risks, and then take the necessary steps to increase the probability of success and reduce the likelihood of failure and its impact. In business, this needs to be balanced against the extra goal of minimizing costs.
That might be the conclusion of the article, except that risk management is so important for any organization that it is helpful to talk more about how it can be achieved.
Identifying and analyzing risk
It is important to understand and be aware of the sources of risks. Risk can come from many places, both internal and external. External risk sources may be, for example:
- unpredictable, for example, from unforeseen regulatory requirements or natural disasters; or
- predictable, relating to operational issues outside the organisation’s control or inflation.
Internal sources of risk include employees and operational decisions. It is important to consider both internal and external sources, to avoid later problems.
Once the source is clear, you then need to analyse the risks, to enable you to prioritize them for assessment and resolution. This is usefully considered in several stages.
- Identification of risks - The first step is to check the lists of possible risk sources and brainstorm the likely risks. Once identified, the risks need to be categorized and prioritized. This is important, because the number of risks identified is almost always greater than the capacity of the team to analyse them and develop contingency plans. Prioritization helps to ensure that attention is focused on the risks with the biggest impact and/or probability of occurrence.
- Assessment of risks - Conventional problem-solving approaches consider that solutions are a consequence of problem identification. Before determining how best to manage risks, it is therefore important to ask questions like:
- What would cause this risk?
- How will this risk affect the organization internally?
Machine learning and analytics solutions can be useful at this stage, particularly to identify what might cause the risk and to model its effect on the organization.
- Development of responses to risks This phase starts the process of assessing possible ways to manage the risk or prevent it from occurring. During this phase, it is helpful to ask two main questions about each risk:
- How could we reduce the likelihood of this risk occurring?
- What are the possible ways that we could manage it if it does occur?
Again, analytics and machine learning are particularly useful in modelling risks and actions to reduce them, because several potential scenarios can be run quickly to assess alternative solutions.
- Development of a contingency plan or preventative measures - The previous stage identified possibilities. This final stage makes decisions about which of the possible options will be put into action, and how this will be done. These decisions depend very much on balancing the effect of the risk with the cost of the mitigation strategy, where modelling can be a vital decision support tool.
This phased method is one way to start enterprise risk management. It should be clear that technology, and particularly analytics, can play a key role in helping organizations to define and align risk appetite with strategy and operations. These tools are likely to be particularly useful in testing options and making decisions about which mitigating action is likely to be most cost-effective. For more about this, please get in touch to discuss your needs.
Learn more
The risk and compliance agenda is more crowded than ever. Financial institutions continue to feel pressure from regulators, auditors, boards and investors to manage risk more proactively and comprehensively. Model risk governance is becoming more and more critical. As a result, financial institutions must operate their risk and finance functions in a more unified, cost-conscious and transparent manner that requires tighter organizational integration and more informed reporting.
