HOLISTIC RISK MANAGEMENT IN PRACTICE First Edition 2002 Reprinted 2009 Reprinted 2010 ISBN 1 85609 227 5 © Paul Hopkin 2002 British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library. Notice of Terms of Use All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of the publisher and copyright owner. While the principles discussed and the details given in this book are the product of careful study, the author and publisher cannot in any way guarantee the suitability of recommendations made in this book for individual problems, and they shall not be under any legal liability of any kind in respect of or arising out of the form or contents of this book or any error therein, or the reliance of any person thereon. Published by Witherby Publishing Group Ltd 4 Dunlop Square, Livingston Edinburgh, EH54 8SB Scotland, UK Tel No: +44(0)1506 463 227 Fax No: +44(0)1506 468 999 Email: info@emailws.com www.witherbys.com W ITHERBY P U BLISHING GRO U PSince-1740 v Foreword Despite the fact that there has been a lot of talk (and that’s largely what it is) about risk management in recent years, there haven’t been many books or indeed any that add much to the literature on risk management from its intellectual heyday of the 1970’s and 1980’s. Discussion about risk management has focused on descriptions and title, e.g. enterprise risk management, holistic risk management, integrated risk management and the Chief Risk Officer, with very little emphasis on action and how to do it in a practical way. I suggest this is because risk management publicity has fallen into the hands of non-practitioners, e.g. consultants, accountants, lawyers and insurance brokers who see the recent fashion for corporate governance (which itself looks a somewhat pathetic concept in the light of what has gone on in a number of well publicised corporate disasters) and what this might produce in new revenues. Historically practitioners have not, since the days of Douglas Barlow, written much about risk management and rarely share their practical experience of assisting with managing risk within their corporations. A concept or business process described by consultants but not supported convincingly by practical and demonstrably successful practice is worthless and is one reason why risk management does not have the credibility it should have. Paul Hopkin has been and indeed is a practitioner and unlike many of his peers comes not from an insurance but a loss control background – an essential distinction if one is to concentrate on managing risk to its full extent. He has also worked for demanding businesses and in one case where I worked with him (yes wearing a non-practising consultancy hat), he not only helped to get the message across to sceptical and profit orientated businessmen but developed a methodology where risk management success or failure was built into both corporate and individual performance. This book reflects this experience and is consequently of value to all concerned with practical risk management. Although wordy this is balanced by the clever idea of including a summary of the author’s views at the end of each chapter and all combined in a full chapter at the end. Indeed this summary might benefit from being separately published as an Executive summary or monograph or perhaps in future editions become a valuable Preface. Holistic Risk Management vi There are many pearls of wisdom in these summaries and Paul Hopkin might reflect on the fact that he can get his message across extremely well in fewer words than he thinks. However, the repetition and ongoing summaries do have the advantage of getting across his message clearly and strongly. He introduces new definitions and initials for the concepts he describes. Many are improvements on the old ones. I like the idea of GRASP (Guardian of the Risk Architecture, Strategy and Protocols) to describe the role of the risk manager and the term ‘Risk Assurance’ to describe the system of managing risk and ‘Risk Response’ to describe loss control strategies. I am less keen on NUDE (No Unplanned Dysfunctional Events) which seems derived from a desire to find words to fit the acronym rather than to explain the concept. This is a quibble and there is no better quibble or low marker than myself. Each section of the book includes an excellent and accessible case study – using as examples a football club, theatre, publisher, personal life, the author gets across his message clearly and students will find the combination of erudition, experience, clear summaries and realistic case studies extremely helpful. Risk management has had an eventful life over the last 30 to 40 years – in the early days it came out of both an academic and practical background which produced many good publications (most of which have stood the test of time), it then got shanghaied by the insurance industry and become far too focused on risk financing, captives etc. More recently it has become pretentious, somewhat hollow with little to offer a dynamic and realistic business enterprise. I hope this book will complete the circle and restore the balance. It deserves to because it focuses on how risk management can contribute to making a business successful. It addresses the need for a practical approach which can be fully understood and communicated throughout the organisation. It is not pessimistic about risk, the opportunities that can arise are dealt with and the importance of taking risk to improve value – which is often ignored by risk managers despite the fact that managers do this all the time – is emphasised and built into the methodologies that Paul Hopkin presents to us. The patient and open-minded reader will get value from this book. Paul Bawcutt March 2002 vii Preface What is planned as strategic or integrative risk management must not degenerate into (or revert to) operational risk response Stakeholders demand continuous improvement in performance. Each time a customer buys a new car, he or she expects it to be better than the previous model. This expectation of continuous improvement in performance places additional demands on organisations. These demands result in organisations needing to achieve necessary and appropriate standards of leadership, competition and efficiency, and the need for continuous evaluation and constant change is thus implied. Constant change creates risks that have to be managed. It is worth noting that more time taken in making a decision allows more information to be collected, however fewer viable options will then remain. Risk management is the initiative of the moment; because it facilitates robust decision-making. In these days of constant change, decisions need to be taken more rapidly. So that risk management can assist with the rapid making of decisions, the various historical approaches to the discipline of risk management need to be brought together and co-ordinated into an effective approach for the future. This “new way forward” must acknowledge the contributions of the past and develop the approaches for the future. “Holistic Risk Management” is a phrase frequently used to describe a particular approach to the management of corporate or business risks. A better description would be the phrase “Holistic Risk Management”. The word integrative implies a more dynamic forward thinking rather than a task that was done in the past and is now complete. Risk management should be predictive, creative and exhaustive, not predicted, created and exhausted. Several other words are also used to describe the concept of “Holistic Risk Management”. These words or phrases include aligned, embedded, strategic, business and ‘total enterprise’. Although it is often difficult to agree terminology, the underlying approach is consistent. This book explores the benefits of the different approaches and seeks to identify the ways in which these ideas can be used to build a fully integrative risk management model. Holistic Risk Management viii If the integrative risk management approach is to be successful, it must find the answer to the question “what should the organisation do about the significant risks that could impact achievement of the corporate mission?”. This requires the identification and evaluation of all potentially significant risks and the treatment, monitoring and review of the priority significant risks faced by the organisation. This approach requires the organisation to identify all of the potentially significant risks, regardless of historical approaches and existing arrangements. The distinctions, insurable or uninsurable, pure or speculative, internal or external, controllable or uncontrollable all hinder an integrative risk management exercise. This book examines the current status of the discipline of risk management and the contribution that risk management tools and techniques can make to the fulfilment of the corporate mission. Risk management currently faces many challenging questions and it is not yet proven that “Holistic Risk Management” will be able to deliver all of the benefits that have been promised by risk management specialists, practitioners and consultants. The fact that risk management is currently a high profile management initiative means that it has become fashionable. Fashion is dangerous in this context, because what is fashionable becomes highly desirable. However, what is fashionable today will, in time, become very unfashionable. The result will be that risk management as a valuable discipline becomes discredited. For those who have experience in risk management, it is strange to find that their discipline is suddenly high profile and everybody claims to be an expert. At the moment, everybody wants to control the risk management agenda. It is important that the risk manager becomes the voice of reason and experience. Part of the task of the risk manager is to ensure that the discipline does not exaggerate the contribution it can make or overstate the scope of application of risk management. Making exaggerated claims will increase the chances of the discipline of risk management becoming discredited. The ideas and concepts discussed in this book are more fully explored and applied in the consolidated case study set out in Appendix B. Note that the ideas are, to some extent, empirical and the concepts are still being developed. Indeed, the discipline itself is currently going though an exciting phase of transfer from empirical theory to established practice. It will continue to develop until (at least) the middle of the first Preface ix decade of this century. Risk Management has strong origins related to hazards and hazard management. Many of the examples used in this book are based on hazard risks and hazard management. The ideas and principles put forward are, however, equally applicable to control risks and opportunity risks. This book is intended to add to the debate on the contribution that risk management can make to the success of an organisation. The aim of all risk management practitioners is to ensure that the discipline continues to contribute to the achievement of the corporate mission. This contribution will only be valued if risk management facilitates a sustained increase in the level of success of the organisation. Paul Hopkin April 2002 xi The Author Paul Hopkin BSc, FIIRSM, FIOSH, FIRM is based in London as the Director of Risk Management for The Rank Group Plc. He was previously Head of Risk Management at the BBC. A former HM Inspector of Factories with the Health and Safety Executive, he is a Fellow of the International Institute of Risk and Safety Management, as well as the Institute of Risk Management and the Institution of Occupational Safety and Health. Paul has recently become a member of the Board of the International Institute of Risk and Safety Management (IIRSM). He is also a former Deputy Chairman of the Association of Insurance and Risk Managers (AIRMIC). Paul is a former chair of the Risk Management Special Interest Group of the Strategic Planning Society. Paul previously held the positions of Loss Control Manager at BET plc, Technical Director at Sedgwick Risk Control Services, Managing Director of Fenchurch Risk Management and Director of Richard Oliver International, part of the Willis (Insurance Brokers) Group. For four years he ran his own consultancy specialising in risk assessment and safety management. xiii Contents Page Foreword v Preface vii Acknowledgements x The Author xi List of Figures and Tables xviii PART 1: INTRODUCTION TO RISK 1 1. NATURE OF RISK 3 1.1 De?nition of Risk 4 1.1.1 Corporate Objectives 7 1.1.2 Stakeholder Expectations 8 1.1.3 Core Processes 9 1.2. Types of Risk 10 1.2.1 Hazard Risks 12 1.2.2 Control Risks 14 1.2.3 Opportunity Risks 15 1.3. Risk Exposure 16 Summary and Review of Chapter 1 18 Case Study 1: Premiership Football Club – (Part 1) 19 2. NATURE OF RISK MANAGEMENT 21 2.1. Risk Management Discipline 22 2.1.1 Recognition of Risks 24 2.1.2 Ranking of Risks 25 2.1.3 Reassurance of Control 26 2.1.4 Response to Signi?cant Risks 28 2.1.5 Reaction Planning 30 2.1.6 Reporting and Monitoring 31 2.1.7 Review of Risk Assurance Management System 31 2.2. Expectations of Risk Management 32 2.2.1 Risk Management Activities 34 2.2.2 Risk Management Outputs 35 2.2.3 Risk Management Professionals 36 2.3. Risk Productivity 37 Summary and Review of Chapter 2 39 Case Study 2: Theatre – (Part 1) 40 Holistic Risk Management xiv PART 2: RISK MANAGEMENT IN CONTEXT 41 3. STYLES OF RISK MANAGEMENT 43 3.1. Styles of Risk Management Explained 44 3.1.1 Hazard Management 48 3.1.2 Control Management 49 3.1.3 Opportunity Management 50 3.2. Risk Management Contribution 51 3.2.1 Contribution of Hazard Management 52 3.2.2 Contribution of Control Management 53 3.2.3 Contribution of Opportunity Management 53 3.3. Reform to Conform to Perform 54 Summary and Review of Chapter 3 57 Case Study 3: Magazine Publisher – (Part 1) 58 4. EMBEDDING RISK MANAGEMENT 59 4.1. The Business Cycle 60 4.1.1 Mission Statement 61 4.1.2 External Evaluation 62 4.1.3 Internal Evaluation 62 4.1.4 Stakeholder Expectations 63 4.1.6 Core Processes 65 4.2. Embedding Risk Management 67 4.2.1 Risk Management and Operations 67 4.2.2 Risk Management and Project 68 4.2.3 Risk Management and Strategy 70 4.3. Alignment of Risk Management 71 Summary and Review of Chapter 4 72 Case Study 4: Theatre – (Part 2) 73 PART 3: FIRM RISK SCORECARD 75 5. CLASSIFICATION OF RISKS 77 5.1 Short, Medium and Long Term Risks 78 5.1.1 Short Term Risks 78 5.1.2 Medium Term Risks 79 5.1.3 Long Term Risks 79 5.2 FIRM Risk Scorecard 80 5.2.1 Financial Risks 83 5.2.2 Infrastructure Risks 84 5.2.3 Reputational Risks 86 5.2.4 Marketplace Risks 88 Contents xv 5.3 Risk Capacity 89 Summary and Review of Chapter 5 92 Case Study 5: Personal Risk Pro?le – (Part 1) 93 6. IDENTIFICATION OF SIGNIFICANT RISKS 95 6.1. Risk Recognition 96 6.1.1 Corporate Objectives 97 6.1.2 Stakeholder Expectations 98 6.1.3 Risk Mapping 99 6.1.4 Key Dependencies 100 6.1.5 Top Ten Risks from each Department 101 6.1.6 CEO Opinion 102 6.2. Signi?cant Risks 103 6.2.1 Risk Matrix 105 6.2.2 Risk Signi?cance 106 6.2.3 Risk Priorities 107 6.2.4 Risk Analysis 110 6.2.5 Risk Register 112 6.3 Utilising Risk Capacity 113 Summary and Review of Chapter 6 114 Case Study 6: Chemical Road Tankers – (Part 1) 115 PART 4: RISK MANAGEMENT STRUCTURE 117 7. RISK MANAGEMENT RESPONSIBILITIES 119 7.1. Risk Management Structure 120 7.1.1 Risk Management Policy 121 7.1.2 Responsibility for Risk Management 122 7.1.3 Risk Management Committee 123 7.1.4 Audit Committee 124 7.2 Risk Guidelines 126 7.2.1 Risk Assessment 129 7.2.2 Risk Control 129 7.2.3 Risk Resourcing 130 7.2.4 Event Management 130 7.2.5 Risk Assurance 131 7.3 Ownership of Risk 132 Summary and Review of Chapter 7 133 Case Study 7: Magazine Publisher – (Part 2) 134 Holistic Risk Management xvi 8. RISK AND THE RISK MANAGER 135 8.1. Role of the Risk Manager 136 8.1.1 Historical Role of the Risk Manager 136 8.1.2 Developing Role of the Risk Manager 138 8.1.3 Chief Risk Of?cer 140 8.2. Guardian of the RASP 141 8.2.1 Risk Architecture 142 8.2.2 Risk Strategy 143 8.2.3 Risk Protocols 144 8.3 Barriers to Implementation 144 Summary and Review of Chapter 8 147 Case Study 8: Chemical Road Tankers – (Part 2) 148 PART 5: SUMMARY AND REVIEW 149 9. ACHIEVING RISK PRODUCTIVITY 151 9.1 Twelve Steps to Risk Productivity 152 9.1.1 Mission of Organisation 154 9.1.2 Corporate Objectives 154 9.1.3 Stakeholders 156 9.1.4 Stakeholder Expectations 157 9.1.5 Core Processes 157 9.1.6 Key Dependencies 158 9.1.7 Signi?cant Risks 159 9.1.8 Risk Priorities 161 9.1.9 Analysis of Signi?cant Risks 162 9.1.10 Risk Capacity 163 9.1.11 Response to Signi?cant Risks 164 9.1.12 Risk Productivity Indicators 166 9.2 Risk Register 167 9.3 Risk Assurance Management System 168 Summary and Review of Chapter 9 172 Case Study 9: Premiership Football Club – (Part 2) 173 10. REVIEW OF KEY MESSAGES 175 10.1 Chapter Messages 176 10.1.1 Management of Risks in Context 177 10.1.2 Management of Core Processes 177 10.1.3 Level of Sophistication 178 10.1.4 Alignment of Risk Management 178 10.1.5 FIRM Risk Scorecard 178 10.1.6 Signi?cant Risks 179 Contents xvii 10.1.7 Risk Guidelines 180 10.1.8 RASP and the Risk Manager 180 10.1.9 Risk Productivity Indicators 181 10.1.10 Risk Capacity 181 10.2. Risk Management and the Mission 182 10.2.1 Integrative Risk Management 185 10.2.2 Holistic Risk Management 185 10.2.3 Aligned Risk Management 186 10.2.4 Embedded Risk Management 187 10.3. Future for Risk Management 188 Summary and Review of Chapter 10 191 Case Study 10: Personal Risk Pro?le – (Part 2) 192 APPENDICES 193 Appendix A: De?nitions and Terminology 195 Appendix B: Consolidated Case Study 205 1. Outline of Case Study 206 2. Twelve Steps to Risk Productivity 207 3. Risk Register 217 Summary and Review of Case Study 220 Classi?cation of Risks 89 Marketplace risks will be mainly commercial for those organisations that sell services or products. For other organisations, such as charities, these will be the risks related to the ability to raise funds in the marketplace. Failure to control these risks will result in inadequate sales or funds for the organisation. Poor management of these risks may result in a presence gap for the organisation. Typical control mechanisms for marketplace risks include the structured and monitored development of business strategy and the introduction of procedures to undertake opportunity assessment of new business activities and proposals. There will be a range of benefits associated with using the FIRM Risk Scorecard, as part of implementing the risk productivity approach. These benefits can be presented using the structure of the FIRM Risk Scorecard. Under the marketplace heading, the benefits will include: • commercial opportunities maximised • better marketplace presence • increased customer spend, and satisfaction • higher level of business successes • lower level of business disasters 5.3 Risk Capacity Most organisations make adequate profits, but take too much risk and/or make inappropriate use of the risk capacity of the organisation. Figure 6 is an illustration of the consolidated risk capacity of an organisation. It shows the level of risk that the board is willing to take under each of the headings of the FIRM Risk Scorecard. Risk capacity is not the same as the cumulative total of all of the individual values at risk associated with the risks facing the organisation. This cumulative total is the risk exposure of the organisation. Risk capacity is the total value of the corporate resources that the board of the organisation is willing to put at risk. The risk capacity is the sum of hazard tolerance plus control acceptance plus opportunity appetite. Risk capacity represents a component of the overall resources of the organisation, as mentioned in chapter 1. Most organisations have not determined the value that it should have at risk (risk capacity) nor calculated how much value is actually at risk (risk exposure). Holistic Risk Management 90 Underpinning the current level of interest in risk management is the idea that risk is a single transferable commodity within the organisation. If this is true, then an organisation should be able to decide how much it wishes to put at risk. The purpose of agreeing risk capacity is to ensure that the organisation does not put too much, or too little, value at risk. It may be acceptable for the organisation to have a total risk exposure that is greater than the risk capacity, provided that there are uncorrelated risks in the portfolio of significant risks. This analysis requires a level of sophistication that is not explored in detail in this book. Financial risksInfrastructure risks Reputational risksMarketplace risks Illustration of Risk Capacity using the FIRM Risk Scorecard Opportunity appetite Hazard tolerance Opportunity appetite = Control acceptance + Hazard tolerance + Opportunity appetite Risk capacity Hazard tolerance Control acceptance Hazard toleranceHazard tolerance Opportunity appetite Opportunity appetite Figure 6: FIRM Risk Scorecard Classi?cation of Risks 91 The organisation is unlikely to have equal risk capacity under each of the four headings of the FIRM Risk Scorecard. The risk capacity of the organisation needs to be fully utilised to ensure that it is used to maximum benefit. Similarly the organisation should not put more value at risk than is appropriate, given the sector in which it operates and the prevailing market conditions. Fully utilising and correctly allocating risk capacity will help achieve risk productivity. Note that the risk capacity relates to the agreed allocation of values at risk and not the anticipated values of the range of possible outcomes. The value of the outcomes is influenced by the application of risk management tools and techniques to the CASE that materialise after the agreed value has been put at risk.