4. risk treatment (risk mitigation)
• selecting and implementing response to risks
• in line with organizations risk approach and risk
appetite
• decisions as to whether particular risks should be
avoided, reduced, shared (transferred) or accepted
5. risk treatment common methods
• avoidance
• reduction – internal control
• sharing (transfer)
– insurance
– portfolio diversification
– hedging
– outsourcing
• acceptance
• other less common methods
6. risk avoidance
• hold back or exit risk related activities
• in terms of product, geographical region, customer
segment, etc.
• simple and commonly used method
7. risk reduction
• based on prioritization of risks by risk matrix
• activities to reduce:
– likelihood (probability) of a risk
– severity (consequences) of a risk
– both aspects
• costs and benefits taken into consideration
• implemented mostly by internal control
• could be performed by risk function (run by CRO),
internal audit or compliance
8. risk reduction – internal control
• system established to provide reasonable
assurance of effective and efficient operation
• internal controls:
– financial (e.g. financial ratios, budgets, variance analysis)
– non-financial quantitative (e.g. customer satisfaction,
wastage, personnel rotation)
– qualitative (e.g. plans, procedures, rules, access to
computers or buildings, project management, corporate
culture)
9. risk sharing – insurance
• protection against hazards by taking out an insurance
policy against an uncertain event
• involves payment of a premium to an insurer which
will compensate the loss in case of event occurance
10. risk sharing – diversification
• using idea of ”don't put all your eggs in one basket”
• wider range of activities/investments lowers the risk
11. risk sharing – hedging
• in relation to ‘underlying’ factor (e.g. interest rate,
currency exchange, commodity, share or bond price)
• protection from unfavorable movement of an
‘underlying’ while still benefit from favorable
movement
• implemented by instruments with opposite-value
movements to the ‘underlying’ (i.e. negative
correlation)
12. risk sharing – outsourcing
• transfer activities or processes to third party
13. risk acceptance
• precise definition what could be accepted
• no action taken in relation to the risk
• should be covered by day-to-day business activities
and its budget
14. risk treatment less common methods
• quality management
• lobbying
• strategic alliances
• mergers and acquisitions
15. RM process
Risk treatment
Ryanair case – create risk treatment ideas
16. risk list
company related
1. fuel costs and availability
2. rapid growth of the company
3. website or check-in systems breakdown
industry related
1. some of government air travel taxes
2. threat of terrorism
3. currency exchange fluctuations
17. risk monitoring
• continuous process based on risk policy
• could be performed by more than one organization
unit/function
• many methods, commonly used: checklists, risk
register, information scanning, media monitoring
• most important items form risk register are subject
of risk reporting
18. risk register – examples of criteria
• risk number (an unique identifier)
• risk category
• description of risk
• date risk identified
• name of person who identified risk
• likelihood
• consequences
• a monetary value, if such can be allocated to the risk
• interdependencies with other risks
19. risk reporting
• based on current data and monitoring process
• should cover identified and analyzed risks along with
risk response
• in line with financial reporting
• information to management and the Board
• meet regulatory reporting requirements (e.g. SOX or
Basel II)
• part of investor relations reporting (in annual report)
