Risk and risk management: categories of risk

A company that imports its raw materials and sells on credit faces many risks at once. The naira may fall. A big customer may not pay. A strike may stop the factory. A competitor may launch a better product. A newspaper story may damage the brand. Some of these can be insured or controlled. Others have to be accepted because without risk there is no profit. Risk management is the skill of deciding which is which.

This topic covers what risk is, the difference between pure and speculative risk, what risk management is and who is responsible for it, the elements of a risk management system, the main categories of business risk, and the key concepts of exposure, residual risk, the changing nature of risk, risk appetite and the risk-based approach. The previous area covered strategic management.

The next topic covers how risks are identified, assessed and measured. Neither the May 2014 nor the November 2014 Pathfinder sets a stand-alone question on this topic, but risk appears inside many scenario questions.

Key terms in plain English

Syllabus check

This topic is in syllabus area C (risk management, 5% of the marks). It covers:

• the nature of risk, risk management and risk responsibilities;
• the categories of business and financial risk;
• exposure, risk appetite and a risk-based approach.

CAMA 2020 and risk

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria.

The nature of risk

Risk usually suggests that things may go wrong, but it is wider than that. Risk exists whenever a future event or outcome cannot be predicted with certainty and a range of outcomes is possible.

Pure and speculative risk

• Pure risk (downside risk): the outcome may be worse than expected but not better. Examples: employees injured by a machine; key staff on strike. The expected result is that nothing happens.
• Speculative risk (two-way risk): the outcome may be better or worse. Examples: a share price; a choice between a fixed and variable rate loan; a new product whose sales may be above or below forecast.

Companies face both. Pure risks can often be controlled by internal controls or insurance and are called internal control risks or operational risks. Speculative risks cannot be avoided because risk must be taken to earn profit. Higher risk should be justified by higher expected profit, and the company must decide what level is acceptable. Speculative risks are usually called business risk, strategic risk or enterprise risk. Many decisions carry both kinds.

The nature of risk management

Risk management is the culture, structures and processes aimed at achieving opportunities while controlling unwanted results. It links risk to return. The safest strategy, to take no risk, is not realistic. Strategies should be consistent with the amount of business risk the company will accept, targets should be realistic for those strategies. Downside risks should be managed while business risks are limited.

Responsibility

Risk management is a corporate governance issue. The board must protect the company’s assets and the shareholders’ investment, keep strategic risk within limits shareholders would expect, and avoid or control operational risk. The Cadbury Report (1992) described it as the process by which executive management, under board supervision, identifies the risk from the business and sets priorities for control.

The Nigerian SEC Code of Corporate Governance for Public Companies makes risk identification and monitoring a board duty and allows a risk management committee. The board defines risk policy, risk appetite and risk limits and makes sure they are built into daily operations.

ICAN also cites the Financial Reporting Council of Nigeria code, which requires at least an annual thorough risk assessment, disclosure of risk policies in the annual report and a review of effectiveness each year.

The International Corporate Governance Network (ICGN) guidelines say the board decides risk strategy and the business model and oversees a risk management system. Management develops and runs it within the board’s strategy. Shareholders assess how well the board oversees risk but are not themselves responsible for it.

The UK Turnbull guidance, which ICAN uses as a model, asks the board to consider:

• the nature and extent of the risks
• the extent and categories of risk it will accept
• the likelihood that risks will occur
• the ability to reduce likelihood or impact
• the cost of the controls against the benefit

Note: that guidance has since been replaced in the UK. The questions it asks remain useful.

Elements of a risk management system

1. A culture of risk awareness, including an understanding of the risk appetite.
2. Processes to identify, assess and measure risks, then to prioritise them and design controls.
3. Efficient communication of risk information to managers and the board.
4. Monitoring to confirm that objectives are met within acceptable risk.

A company may set up a risk management committee of the board, and a senior management committee, perhaps chaired by the chief executive, to identify and assess risks, agree internal control programmes and monitor effectiveness. Risk management should operate at board level (with independent non-executive directors) and at operational level.

Categories of risk

There is no standard classification, because risks differ by business. Categories give structure: a risk committee may take charge of each one, and the board can report on internal control by category. The Turnbull report listed eight common risks, and the syllabus adds derivatives risk.

Derivatives risk

Commodity derivatives are contracts on prices such as oil, wheat or metals. Financial derivatives are contracts on rates and prices such as exchange rates, interest rates and share prices. Most are settled by paying the difference between the contract price and the market price, not by delivering the item.

Options, futures and swaps can hedge price risk or be used to speculate, and heavy losses have occurred when treasury teams speculated. Every company with a treasury needs controls. A credit default swap works like credit protection: the seller pays the buyer if a borrower defaults, and a buyer need not hold the debt.

Business and financial risk

The board must weigh risk and return in strategy. Business risks threaten the survival of the business and vary by firm and over time. Failure is more common in cyclical industries (such as tourism) and among start-ups, but the 2008-09 banking crisis showed that old, stable firms can fail too.

Financial risk is a major cause of business risk: cash flow and liquidity problems, working capital management and the financial structure all matter. Debt may be cheaper or necessary when equity is unavailable but it raises financial risk.

ICAN gives Marconi as a warning: the board changed strategy from defence to telecoms, did not understand the scale of the risk and had no systems to warn it, and the equity value collapsed.

Risks by sector

The same risk matters more in some industries than others. Credit risk is central for banks and less so for oil companies. Environmental regulation is a bigger issue for oil than for banks. Significance changes over time, so companies must watch for new risks and for old risks that have grown, and not spend effort on risks that no longer matter.

Key concepts

Exposure

Exposure is the amount that would be lost if conditions turned against the company. A Nigerian company holding US$2m is exposed to a fall in the dollar against the naira. A holder of ₦100m of shares is exposed to a fall in the market. A company owed ₦500,000 has that credit exposure. Exposure is not the expected loss, because not all of it will be lost.

Some risks, such as reputation, are qualitative and cannot be measured, so judgement is needed.

Residual risk

Controls cannot remove all risk. The exposure left after control is the residual risk. If it is too high, add more control until it is acceptable.

The dynamic nature of risk

Risk is not fixed. On a scale from static to dynamic (turbulent), real organisations lie in between. Even stable settings can change suddenly, as financial institutions found in 2008-09. Firms in more dynamic environments need to invest more in risk management. A commodity-rich economy such as Nigeria is exposed to an unexpected fall in commodity prices.

Risk appetite

Risk appetite is how much risk the board will take for the chance of profit. For a trader it is the capital they are willing to lose for a potential gain. It depends on the nature and importance of the decision, the size of potential gains and losses, and the reliability of the information. A board may have appetite for one risk and aversion to another.

The board should set the appetite and a risk policy, and tell managers what is legitimate. Without it, decisions are inconsistent: erratic risk-taking is “an accident waiting to happen”. A risk-averse culture is also bad because it blocks opportunities.

A risk-based approach

Decisions come from a detailed evaluation of risk and exposure and a policy on acceptable risk. With capital budgeting, a project should be accepted only if its NPV is positive and its risk is acceptable. A risk-based approach differs from box-ticking. A customs service that searches every passenger is box-ticking. One that selects the passengers most likely to smuggle, from a risk assessment, is risk-based.

The rules in more depth

Why a pure risk can be insured and a speculative risk cannot

An insurer will cover a loss that may or may not happen. It will not cover the chance that a new product sells less than hoped, because that is a business choice.

Why liquidity risk is separate from profit

A profitable company can run out of cash if its money is tied up in receivables or inventory. Profit does not pay suppliers.

Why exposure is not the expected loss

Exposure is the maximum at risk. The expected loss is smaller, and depends on the chance and size of the adverse event.

Why a risk appetite statement matters

It gives managers limits to work within, so that they neither take reckless risks nor refuse every opportunity.

Effect on analysis

In a scenario, classify the risk, size the exposure, name who owns it and say what control is proportionate to the benefit.

Worked examples

1. (a) Pure, operational, insurable.
2. (b) Speculative, market risk, can be hedged.
3. (c) Speculative, strategic.
4. (d) Pure and operational, though the cost of switching supplier is a business risk.

1. Exposure = US$2m.
2. Naira value falls by 2m × 100 = ₦200m.
3. The loss is the effect of the move on the exposure, not the whole ₦3,000m value.

1. Credit exposure = ₦100m.
2. If all of it went bad, insurance would pay ₦70m.
3. Residual risk.
   100 − 70 = ₦30m.
   If the board cannot accept ₦30m, it should add more control, such as tighter credit limits.

1. A positive NPV alone is not enough.
2. The risk is outside the appetite, so reject A or change the structure, for example by agreeing a long contract.
3. This is the risk-based approach.

How to score full marks

• Classify each risk by type and category.
• Give the exposure and its measure where you can.
• Name the owner: the board sets appetite; management manages.
• Match the control to the benefit and to the appetite.
• Separate pure risk (control, insure) from speculative risk (accept and manage).
• End with a recommendation.

Common mistakes in the exam

• Treating risk as only bad news.
• Calling all risks insurable.
• Confusing exposure with expected loss.
• Leaving out the board’s responsibility.
• Listing categories without applying them.
• Forgetting that qualitative risks need judgement.

Quick revision

• Pure risk: downside only. Speculative: two-way.
• Board owns risk strategy, appetite and policy.
• Categories: market, credit, liquidity, technological, legal, HSE, reputation, probity, derivatives.
• Exposure, residual risk, appetite, risk-based approach.
• CAMA 2020: ss. 305, 308, 385, 404(7).

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.