Brought to you by Waterstons

Risk Management

By Helen McMillan

How to identify where the risks in your business are right now and use them to make your business safer and more resilient in unprecedented times.

Helen McMillan

Helen McMillan

Executive Business Consultant
Part 1: Exploring Risk

Categorise the level of risk

Likelihood vs Impact

So how do we know how likely our risks are to occur and if they do occur, what the impact would be to us?

Once you have defined your risks, you should look at the likelihood and the impact. Let’s look at how we would do that.

Likelihood vs Impact

Risks should be assessed by impact and likelihood, whilst issues and events are normally only classified by impact.

  • Both financial and non-financial considerations
  • It should be determined on the basis that the risk or issue has crystallised or an event has occurred
  • The overall rating should be based on the highest impact from individual financial or non-financial criteria
  • In terms of the classification, the parameters for minor, moderate, major, and critical are defined. For example, Moderate would be between 3 and 5% of colleagues unable to perform their role effectively, specific actions needed at a local management level, short term re-allocation of resource etc
  • An assessment of how frequently the risk is expected to occur
  • An assessment of internal / external data loss, adequacy and effectiveness of key controls, and split of automated v manual controls
  • A management judgement, considering all relevant internal and external experience
  • Likelihood should be assessed within 4 frequencies:
    • Once in 10 years (unlikely) – or 10% chance of occurring in any year
    • Once in 5 years (possible) – or 20% chance of occurring
    • Once in 2 years (likely) – or 50% chance of occurring
    • Once in 12 months (almost certain) – or almost certain of occurring

How do we know what the impact is?

Let’s look at impact classification in a bit more detail.

For each business, a different set of criteria may be used – and this can be specific to your organisation but must have clear parameters and fit in with your risk appetite, for example, what you have defined as being acceptable levels of risk in your business.

If a risk sits across a number of these ratings, for example, it may be moderate/ low for customer and people, but medium for financial and regulatory, and critical for management, then the highest risk category is used. This would be categorised as Critical / High.

CategoryModerate (Low)Major (Medium)Critical (High)
People3-5% of workforce is impacted5-10% of workforce is impactedIn excess of 10% of workforce impacted
Customer1%-3% of customer base impacted3%-5% of customer base impactedMore than 5% of customer base impacted
Financial1%-5% of profit5%-10% of profitMore than 10% of profit
RegulatoryEscalation is required to regulatorInvestigation required by regulatorSanctions / enforcement by regulator
ManagementBusiness Unit level involvementLeadership Team involvementSignificant LT remediation/ actions
SummaryModerate impact, relative to profit or capital. Unlikely to require revisions to financial or strategic plansMajor financial impact, relative to profit or capital. May require some revision to financial or strategic plansCritical financial impact, relative to profit or capital. Likely to require revision to financial or strategic plans

Overall Risk Classification

Once we have defined our rating for ‘Impact’ and our rating for ‘Likelihood’, we can plot our risks and give them a classification.

For example, a risk that we define as being likely to happen and the impact of it happening being major would be given a rating of 'High'.

risk table

So which risks are the 'riskiest'?

Risk chart

Which risks sit within the upper right hand quadrant of the chart?  Those are the risks that you should address first – they are not necessarily where the business focus needs to be however they should be looked at as the ones that could cause the biggest impact if they materialise. These risks very often have a significant financial cost to control and therefore the cost to the business if they happened, can sometimes be less than the cost to control.

Look at each of the risks and identify what the plan to address would be. The plan will most likely take one of the following forms:

  • Avoid: Take steps to ensure that the risk does not happen. This is the preferred option but is not always the available option
  • Transfer: Find someone outside the team who is better positioned to take care of the risk or transfer the risk to a 3rd party, for example, a supplier
  • Accept: Recognise that you have done all you can to address the risk, or there are no controls that can be taken. Take no action and be comfortable with the results if the risk happens.
  • Mitigate: Take steps to reduce the impact and/or probability of the risk. This is most often the response.

The important bit to note is that the ones that you think your effort should be focused on ie the most costly risks, are not always the ones you should be looking at. The ones that are normally where the focus is, are those with moderate impact and moderate likelihood. These are the ones that we should look at most often.

So which are the riskiest risks that we have identified in our matrix?

Putting it all together

Think about a project that you are working on just now, or have worked on in the past.

  • Identify a Risk to the project
  • Document the Risk, Cause and Impact
  • Define the Probability of the risk happening
  • Think about the Cost to the business or the client if the risk materialised
  • Identify appropriate Controls you could put in place to reduce the likelihood
  • Determine if you can reduce the level of Risk as a result of the controls