The Evolution of Risk Management and The Risk Management Process

Transcription

1 The Evolution of Risk Management and The Risk Management Process

2

3

4 The Evolution of Analytical Risk-Management Tools 1938 Bond Duration 1952 Markowitz mean-variance framework 1963 Sharpe s capital asset pricing model 1966 Multiple factor models 1973 Black-Scholes option pricing model 1979 Binomial option model 1983 Risk-adjusted return 1986 Limits on exposure by duration bucket 1988 Risk-weighted assets for banks 1992 Stress testing 1993 Value at Risk (VAR) 1994 Risk Metrics 1997 Credit Metrics, Credit Risk 1998 Integration of credit and market risk 2000 Entreprisewide risk management

5 Risk management in the 1970s early beginnings Risk was something that was little discussed and its effects on businesses and project6s were ignored Risk management in the 1980s quantitative analysis predominates Part of project management The use of methods based on risk and response diagrams There are four reasons why risk response should be considered as part of risk analysis: 1. Estimation of the remaining risk is normally different in different response scenarios 2. Responses need time and money 3. A correct quantitative risk analysis model needs to include both risks and responses 4. A specific response to a risk may bring secondary risks that will not exist in other cases

6 Risk management in the 1990s emphasis on methodology and processes The simple generic risk management process identification, assessment, response and documentation The five-phase generic process process scope, team, analysis and quantification, successive breakdown and quantification, and results

7 Risk Management Merna (1996) define risk management as any set of actions taken by individuals or corporations in an effort to alter the risk arising from their business Handy (1999) summarizes risk management as: risk management is not a separate activity from management, it is management predicting and planning allow prevention reaction is a symptom of poor management. Meulbroek (2002) identifies that the goal of risk management is to MAXIMISE SHAREHOLDER VALUE

8 Smith (1995) states that risk management is an essential part of the project and business planning cycle which: 1. Requires acceptance that uncertainty exists 2. Generates a structured response to risk in terms of alternatives plans, solutions and contingencies 3. Is a thinking process requiring imagination and ingenuity 4. Generates a realistic attitude in an investment for staff by preparing them for risk events rather than being taken by surprise when they arrive

9

10 ERM represents a significant evolution beyond previous approaches to risk management in that it: 1. Encompasses all areas of organizational exposure to risk (financial, operational, reporting, compliance, governance, strategic, reputational, etc.); 2. Prioritizes and manages those exposures as an interrelated risk portfolio rather than as individual silos ; 3. Evaluates the risk portfolio in the context of all significant internal and external environments, systems, circumstances, and stakeholders; 4. Recognizes that individual risks across the organization are interrelated and can create a combined exposure that differs from the sum of the individual risks;

11 5. Provides a structured process for the management of all risks, whether those risks are primarily quantitative or qualitative in nature; 6. Views the effective management of risk as a competitive advantage; and 7. Seeks to embed risk management as a component in all critical decisions throughout the organization.

12 Risk management involves: 1. Identifying risks 2. Predicting how probable they are and how serious they might become 3. Deciding what to do about them 4. Implementing these decision

13 The risk management process Smith (1995) the process of risk management involves: 1. Identification of risk/uncertainty 2. Analysis of implications 3. Response to minimize risk 4. Allocation of appropriate contingencies

14 Eight phases in the risk management process Chapman and Ward (1997) identifies eight phases in the risk management process: 1. Define 2. Focus 3. Identify 4. Structure 5. Ownership 6. Estimates 7. Evaluate 8. Plan

15 PMBOK (1996) in project risk management PMBOK (Project Management Body of Knowledge) gives the necessary processes: Risk identification Risk quantification and analysis Risk response

16

17 Risk Management Model

18 ERM and Organization

19

20

21

22 Risk Identification (1) Risk identification consists of determining which risks are likely to affect the project and documenting the characteristics of each one. Risk identification should address both the internal and external risks The process includes: Inputs and outputs of the risks identification process Participants in the risk management process Information gathering and project definition Risk identification process outputs

23 Risk Identification (2) The purpose of risk identification is: To identify and capture the most significant participants (stakeholders) in risk management and to provide the basis for subsequent management To stabilize the groundwork by providing all necessary information to conduct risk analysis To identify the project or service components To identify the inherent risks in the project or service

24 START ASSIGN RISK MENAGEMENT PROCESS RESPONSIBILITY INFORMATION DEFINE INVESTMENT/ PROJECT STAKEHOLDERS RISK IDENTIFICATION PROCESS TECHNIQUES OUTPUTS

25 Outputs of Risk Identification Register of risk with validated descriptions of their characteristics Clear understanding of threats and opportunities associated with the project by all stakeholders Initials risk response options

26 Risk Quantification and Analysis Risk quantification and analysis involves evaluating risks and risk interactions to assess the range of possible outcomes The major output from risk quantification and analysis is a list of opportunities that should be pursued and threats that require attention The purpose of risk management is to determine the balance which exist between risk and opportunities in order to assist management responses to tilt the balance in favor of the opportunities and away from risks

27 OUTPUTS FROM RISK IDENTIFICATION PROCESS INFORMATION SCREENING QUANTITATIVE ANALYSIS TECHNIQUES STAKEHOLDERS RISK ANALYSIS PROCESS QUALITATIVE ANALYSIS TECHNIQUES OUTPUTS

28 Outputs of Risk Quantification and Analysis A clear understanding of which threats require response and which opportunities should be pursued Appreciation of risk exposure distribution within the investment/project by all stakeholders Most significant risks Variation of project outcome values with risk occurrences Probability distributions of project outcome values

29 Risk Response Risk response involves defining enhancement steps for opportunities and response to threats. Response of threats generally fall into one of the following categories: Risk avoidance Risk reduction Risk transfer Risk retention

30 OUTPUTS FROM RISK ANALYSIS PROCESS INFORMATION RISK RESPONSE TECHNIQUES RISK RESPONSE OPTIONS RISK RESPONSE PROCESS STAKEHOLDERS RISK RESPONSE METHODS OUTPUTS

31 Outputs of Risk Response The alternative strategies for dealing with the significant risks The strategy or strategies chosen for implementation in each case Allocation of risk among project parties

32 Benefits of Risk Management (1) According to Chapman and Ward (1997): The risk associated with the project or business are defined clearly and in advance of the start Management decisions are supported by through analysis of the data available Improvement of project or business planning by answering what if questions with imaginative scenarios The definition and structure of the project or business are continually and objectively monitored Provision of alternative plans and appropriate contingencies and consideration concerning their management as part of risk response The generation of imaginative responses to risks The building up of a statistical profile of historical risk which allows improves modeling for future projects

33 Benefits of Risk Management (2) Project or business issues are clarified, understood and allowed from the start of a project Decisions are supported by through analysis of the data available The structure and definition of the project or business are continually and objectively monitored Contingency planning allows prompt, controlled and previously evaluated responses to risks that may materialize Clearer definitions of specific risks are associated with a project or business Building-up statistical profile of historical risk to allow better modeling for future projects and investments

34 Hard benefits Enables better informed and more believable plans, schedules and budgets Increases the likelihood of a project adhering to its plans Leads to the use of the most suitable type of contract Allows a more meaningful assessment of contingencies Discourages the acceptance of financially unsound projects Contributes to the build up of statistical information to assist in better management of future projects Enables a more objective comparison of alternatives Identifies, and allocates responsibility to, the best risk owner

35 Soft benefits Improves corporate experience and general communication Leads to a common understanding and improved team spirit Assists in the distinction between good luck/good management and bad luck/bad management Helps develop the ability of staff to assess risks Focuses project management attention on the real and most important issues Facilities greater risk taking thus increasing the benefits gained Demonstrates a responsible approach to customers Provides a fresh view of the personnel issues in a project

36 Beneficiaries of Risk Management An organization and its senior management Clients, both internal and external Project managers who want to improve the quality of their work

37 Embedding risk management into organization Turnbull Report (1999) identifies: Risk identification Risk assessment/measurement Understand how the risks are currently being managed Reports the risks Monitor the risks Maintain the risk profile

38 Risk Management Plan Based on findings by Merna (2002): Assignment of risk management responsibility The corporate risk management policy Risk identification documentation Risk analysis outputs Selected risk response options Monitoring and controlling Maintenance of the risk management system Evaluation

39 Risk Management System (RMS) According to Fraser (2003): Executive level sponsorship and leadership for the programme is required An RMS requires cultural and behavioral change The operating management and business owners must take ownership of and be committed to the programme There must be a formal structure and framework in place