Identification, assessment and measurement of risk

A company lists forty risks. If it treats them all alike, it spends the same effort on a paper-clip theft and a fire that could close the factory. Good risk management first finds the risks, then judges how likely each is and how much it would cost, then measures what can be measured and ranks the rest by judgement. Only then does it decide where to spend money on control.

This topic covers how risks are identified, how a company’s risks affect its stakeholders, how risks are assessed by probability and impact on a risk map, how they are measured (including value at risk), how they are prioritised with a risk dashboard, the board’s role, the ALARP principle, objective and subjective assessment, and related and correlated risks. The previous topic covered the nature and categories of risk.

The next covers monitoring, control and enterprise risk management. Neither the May 2014 nor the November 2014 Pathfinder sets a stand-alone question on this topic.

Key terms in plain English

Syllabus check

This topic is in syllabus area C (risk management, 5% of the marks). It covers:

• identifying, assessing, measuring and prioritising risk;
• the impact of a company’s risks on its stakeholders;
• the ALARP principle and the difference between objective and subjective assessment.

CAMA 2020 and risk assessment

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria.

Risk identification

Identification is the first stage of a risk management system. The company must understand the risks in its environment and markets (strategic risks) and inside the business (operational risks). There are no standard rules. In a large company, risks may be identified at group, division and department level. Management usually identifies strategic risks, while internal or external auditors may be better at finding operational risks and suggesting controls.

Many large companies set up risk committees of managers from several departments, each covering one category of risk or one region, which meet regularly to review risks and changes in them.

Risks differ in importance, so they must then be assessed to rank them, to find the most significant and to find those needing urgent control. Control is justified only if its cost is less than the benefit from reducing the risk.

The impact of risk on stakeholders

A company’s risks create risks for its stakeholders, and their reactions can affect the company.

• Employees: loss of job if strategy fails, threats to health and safety (measured, for example, as serious injuries per 1,000 employees a year) and to benefits. Their appetite may differ from the board’s: a rogue trader may take high risks for a bonus.
• Investors: they buy expecting a certain risk profile, high-growth or stable dividends. The board should keep the company’s risk appetite consistent with its shareholders’. When risk rises, some sell and others buy. The board should disclose significant risks. Listed companies disclose their principal risks in the annual report.
• Creditors: a high-risk company is a high credit risk. They risk non-payment and the loss of the customer.
• Communities and the public: recession and closures in places where the company is a major employer, unsafe goods and pollution. Pressure groups arise when people feel threatened.
• Governments: companies supply wealth, jobs and tax. The risk is that they move abroad (ICAN mentions some Nigerian businesses relocating to Ghana).
• Customers: errors and delays pass through the supply chain, and product safety risks fall on users of food, drink and medicines.
• Business partners: in a joint venture, a partner that reduces its own risk, for example by dominating decisions, changes the others’ risk. Clear contracts and monitoring help.

Assessing risks: probability and impact

Assessment is also called risk profiling or risk mapping. Each risk is judged on the likelihood that loss will occur and the size of the loss. A simple risk map is a 2 × 2 grid:

High-impact, low-probability risks include fire, flood, terrorism and major new legislation. Some, such as fire and theft, can be insured, which reduces residual risk by the amount of cover. Each key risk should be owned by a named manager who takes the control action and reports.

An ongoing process

In dynamic industries (shipping, telecoms, technology), risks must be assessed continuously. ICAN’s example shows how one risk moves on the map. In year 1, a low-geared company in a low-rate environment sees interest rate risk as low impact and low probability. In year 2 it borrows heavily, so it becomes high impact. In year 3 a new government pushes rates up, so it becomes high impact and high probability. The strategy for managing it changes each time.

Measuring risks

Where possible, risks should be quantified, so that maximum tolerance can be set and actual risk tracked against it. Measures may be financial (expected loss) or non-financial (expected injuries). Not every risk can be measured, and qualitative risks rest on judgement.

Value at risk (VaR) is a model banks use for credit and other risks. It estimates, at a given confidence level, the most that will be lost over a period. For example, at 95% confidence, bad debt losses from current borrowers will not exceed ₦5m next month. Banks set VaR limits and compare actual VaR with the limit.

Prioritising risks

The company decides which risks are tolerable and which need more control. Sometimes the answer is that controls are excessive and can be cut. Judgement is common, but a risk dashboard helps. Each risk has a traffic light: red means more control is needed, amber means keep it under review and green means it is under control.

A fuller dashboard shows for each risk the total risk with no control, the residual risk and the risk appetite.

• If residual risk and appetite are in the same band, current control is appropriate.
• If residual risk is in a higher-risk band than appetite, more control is needed.
• If appetite is well above residual risk, controls may be excessive and cost can be saved.

A company is unlikely to have an appetite for a very high (red) risk.

The board’s role

Management identifies key risks (the board may do so with advice from management and auditors), assesses them, designs and runs controls, monitors them and reports regularly to the board. The board has overall responsibility, sets the risk policy and appetite and, under the UK Corporate Governance Code, reviews the effectiveness of internal control and risk management at least annually and reports to shareholders.

The code of the Financial Reporting Council of Nigeria is to the same effect.

The ALARP principle

Low risk is more acceptable than high risk, but not all risk should be avoided because return is usually linked to risk. ALARP, from UK health and safety law, means that it is usually impossible, or grossly expensive, to remove all risk, so the residual risk should be as low as reasonably practicable. A risk is ALARP when the cost of reducing it further is grossly disproportionate to the benefit.

It is a matter of judgement and not a simple cost-benefit sum.

Objective and subjective assessment

If likelihood and impact can both be measured accurately from hard data, the assessment is objective. Otherwise judgement is used and the assessment is subjective. Objective likelihood: a quality failure in a batch of components, from past experience. Subjective likelihood: an oil well disaster this year in a given region. Objective impact: the change in interest payments from a 1% rise in rates.

Subjective impact: the change in revenue from a change in consumer taste. An assessment based on objective data is more robust.

Related and correlated risks

Related risks often occur together. Risks are correlated if they vary together (positive) or in opposite directions (negative), because of a common cause or because one gives rise to another. Correlation shows association, not causation. Smoking raises the risk of both heart disease and lung cancer, so those two are positively correlated through a common cause, and neither causes the other.

A link with no direct connection is spurious. Missing the relationship between risks can lead to the wrong response. ICAN suggests environmental and reputation risk are correlated, and gives the 2010 Deepwater Horizon accident as an example of a company bearing both clean-up and reputation costs.

The rules in more depth

Why probability and impact are not enough alone

A risk that is rare but could end the company needs attention even though its expected loss is small. The map makes this visible.

Why VaR has limits

It says nothing about the loss in the worst 5% of cases, and it relies on past data. It is a limit and a measure, not a guarantee.

Why a dashboard compares residual risk with appetite

Both too little and too much control are costly. The comparison shows where to add control and where to save.

Why correlated risks matter for hedging

If two exposures move together, one hedge may cover both. If they move in opposite directions, they may already offset.

Effect on analysis

In a scenario, list the risks, place them on the map, size the main ones, compare residual risk with appetite and recommend the controls that pass the cost test.

Worked examples

1. (a) High impact, low probability: consider insurance.
2. (b) High impact, high probability: immediate action, such as hedging.
3. (c) Low impact, high probability: consider tighter procedures.
4. (d) Low impact, low probability: review periodically.

1. Expected loss.
   2% × 500 = ₦10m.
2. Insurance removes 90% of that, which is ₦9m of expected loss.
3. Benefit ₦9m exceeds cost ₦6m, so the insurance is justified on cost.
4. Residual expected loss = ₦1m. Because the loss is high, the company may buy it anyway to protect against the worst case.

1. The bank is ₦1.2m over its limit.
2. It should cut the exposure, add collateral or change the loan book to return within the limit.
3. The breach should be reported to the risk committee.

1. Residual risk is in a higher-risk band than the appetite.
2. More control is needed, for example tighter credit limits or insurance.
3. For a risk where appetite is amber and residual risk is green, controls may be excessive and some cost might be saved.

How to score full marks

• List the risks before assessing them.
• Place each on the map and state the action that follows.
• Quantify the main ones, and say which cannot be measured.
• Compare residual risk with appetite.
• Test the cost of each control against its benefit.
• Name an owner for each key risk.

Common mistakes in the exam

• Listing risks without ranking them.
• Placing a high-probability, low-impact risk in the top-priority box.
• Treating VaR as a guarantee.
• Treating correlation as proof of cause.
• Ignoring the effect of company risk on stakeholders.
• Recommending controls that cost more than the risk is worth.

Quick revision

• Identify at all levels; committees and auditors help.
• Stakeholders: employees, investors, creditors, public, government, customers, partners.
• Risk map: probability against impact.
• VaR: maximum loss at a confidence level.
• Dashboard: red, amber, green; residual risk against appetite.
• ALARP, objective and subjective, correlation.
• CAMA 2020: ss. 305, 308, 385, 404(7).

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.