RISK MANAGEMENT

M-2. APPROACHES TO DEFINING RISKS

INTRODUCTION

The Oxford English Dictionary definition of risk is as follows: ‘a chance or possibility of danger, loss, injury
or other adverse consequences’, and the definition of at risk is ‘exposed to danger’. In this context, risk is
used to signify negative consequences. However, taking a risk can also result in a positive outcome. A
third possibility is that risk is related to uncertainty of outcome. Take the example of owning a motor car.
For most people, owning a car is an opportunity to become more mobile and gain the related benefits.
However, there are uncertainties in owning a car that are related to maintenance and repair costs.
Finally, motor cars can be involved in accidents, so there are obvious negative outcomes that can occur.
It is also important to remember the legal obligations associated with car ownership and the rules that
must be obeyed when the car is being driven on a road.

Definitions of risk can be found from many sources, and some key definitions are set out in this module.
An alternative definition is also provided to illustrate the broad nature of risks that can affect
organizations. The Institute of Risk Management (IRM) defines risk as the combination of the probability
of an event and its consequence.

Consequences can range from positive to negative. This is a widely applicable and practical definition
that can be easily applied. The international guide to risk-related definitions is ISO Guide 73, and it
defines risk as the ‘effect of uncertainty on objectives’. This definition appears to assume a certain level
of knowledge about risk management and it is not easy to apply to everyday life. The meaning and
application of this definition will become clearer as the reader progresses through this module.

LEARNING OBJECTIVES
Upon successful completion of this unit, you should be able to:

1) Define and explain risk management

2) Produce a range of established definitions of risk and risk management and describe the
usefulness of the various definitions
3) Identify uncertain future events that may influence achievement of business plans and strategic
objectives

MAIN CONTENT
The Institute of Internal Auditors (IIA) defines risk as the uncertainty of an event occurring that could
have an impact on the achievement of objectives. The IIA adds that risk is measured in terms of
consequences and likelihood. Different disciplines define the term risk in very different ways. The
definition used by health and safety professionals is that risk is a combination of likelihood and
magnitude, but this may not be sufficient for more general risk management purposes.

Given that there are many available definitions for the word risk, it is important that the organization
chooses the definition that is most suitable for its own purposes. The definition can be as narrow or as
comprehensive as the organization wishes. As a version of a comprehensive definition of the word risk,
the author offers the following: An event with the ability to impact (inhibit, enhance or cause doubt
about) the effectiveness and efficiency of the core processes of an organization.
Risk in an organizational context is usually defined as anything that can impact the fulfilment of
corporate objectives. However, corporate objectives are usually not fully stated by most organizations.
Where the objectives have been established, they tend to be stated as internal, annual, change
objectives. This is particularly true of the personal objectives set for members of staff in the organization,
where objectives usually refer to change or developments, rather than the continuing or routine
operations of the organization.

It is generally accepted that risk is best defined by concentrating on risks as events, as in the definition
of risk provided in ISO 31000 and the definition provided by the Institute of Internal Auditors, set out in
Table 1.1. In order for a risk to materialize, an event must occur. Therefore, perhaps a risk can simply be
considered to be ‘an unplanned event with unexpected consequences’. Greater clarity is likely to be
brought to the risk management process if the focus is on events. For example, consider what could
disrupt a theatre performance. The events that could cause disruption include a power cut, the absence
of a key actor, or a substantial transport failure or road closures that delay the arrival of the audience, as
well as the illness of a significant number of staff. Having identified the events that could disrupt the
performance, the management of the theatre needs to decide what to do to reduce the chances of one
of these events causing the cancellation of a performance. This analysis by the management of the
theatre is an example of risk management in practice.

Types of Risks

Risk may have positive or negative outcomes or may simply result in uncertainty. Therefore, risks may be
considered to be related to an opportunity or a loss or the presence of uncertainty for an organization.
Every risk has its own characteristics that require particular management or analysis. In this module,
risks are divided into four categories:
 1. compliance (or mandatory) risks;
2. hazard (or pure) risks;
3. control (or uncertainty) risks;
4. opportunity (or speculative) risks.

In general terms, organizations will seek to minimize compliance risks, mitigate hazard risks, manage
control risks and embrace opportunity risks. However, it is important to note that there is no ‘right’ or
‘wrong’ subdivision of risks. Readers will encounter other subdivisions in other texts and these may be
equally appropriate. It is, perhaps, more common to find risks described as two types, pure or
speculative.

Indeed, there are many debates about risk management terminology. Whatever the theoretical
discussions, the most important issue is that an organization adopts the risk classification system that is
most suitable for its own circumstances. There are certain risk events that can only result in negative
outcomes. These risks are hazard risks or pure risks, and these may be thought of as operational or
insurable risks. In general, organizations will have a tolerance of hazard risks, and these need to be
managed within the levels that the organization can tolerate. A good example of a hazard risk faced by
many organizations is that of theft. There are other risks that give rise to uncertainty about the outcome
of a situation. These can be described as control risks and are frequently associated with project
management. In general, organizations will have an aversion to control risks. Un-certainties can be
associated with the benefits that the project produces, as well as uncertainty about the delivery of the
project on time, within budget and to specification. The management of control risks will often be
undertaken in order to ensure that the outcome from the business activities falls within the desired
range. The purpose is to reduce the variance between anticipated outcomes and actual results.

At the same time, organizations deliberately take risks, especially marketplace or commercial risks, in
order to achieve a positive return. These can be considered as opportunity or speculative risks, and an
organization will have a specific appetite for investment in such risks.

Opportunity risks relate to the relationship between risk and return. The purpose is to take action that
involves risk to achieve positive gains. The focus of opportunity risks will be towards investment. The
application of risk management tools and techniques to the management of hazard risks is the best and
longest-established branch of risk management, and much of this text will concentrate on hazard risks.
There is a hierarchy of controls that apply to hazard risks, and this is discussed in the succeeding module.

Hazard risks are associated with a source of potential harm or a situation with the potential to
undermine objectives in a negative way and hazard risk management is concerned with mitigating the
potential impact. Hazard risks are the most common risks associated with operational risk management,
including occupational health and safety programmes.

Control risks are associated with unknown and unexpected events. They are sometimes referred to as
uncertainty risks and they can be extremely difficult to quantify. Control risks are often associated with
project management and the implementation of tactics. In these circumstances, it is known that the
events will occur, but the precise consequences of those events are difficult to predict and control.
Therefore, the approach is based on managing the uncertainty about the potential impacts and
consequences of these events. There are two main aspects associated with opportunity risks. There are
risks/dangers associated with taking an opportunity, but there are also risks associated with not taking
the opportunity. Opportunity risks may not be visible or physically apparent, and they are often financial
in nature. Although opportunity risks are taken with the intention of obtaining a positive outcome, this is
not guaranteed. Nevertheless, the overall approach is to embrace the opportunity and the associated
opportunity risks. Opportunity risks for small businesses include moving a business to a new location,
acquiring new property, expanding a business and diversifying into new products.

Activity M2- Advance Study Assignment

Answer the following questions in preparation for next week’s discussion:

1. What is risk classification?

______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

2. What type of information is to be included in the risk description?

______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

References:

British Standard BS 31100:2011 Risk Management: Code of Practice and Guidance for the
Implementation of BS ISO 31000, www.standardsuk.com

Hopkin, P. (2018). Fundamentals of risk management: understanding, evaluating and implementing

effective risk management. Kogan Page Publishers.
Pullan, P and Murray-Webster, R (2011) A Short Guide to FacilitatingRisk Management,
www.gowerpublishing.com