John Pentanol was appointed as risk manager at H&Z Company a year ago and he decided that his first task was to examine the risks that faced the company. He concluded that the company faced three major risks, which he assessed by examining the impact that would occur if the risk were to materialise. He assessed Risk 1 as being of low potential impact as even if it materialised it would have little effect on the company’s strategy. Risk 2 was assessed as being of medium potential impact whilst a third risk, Risk 3, was assessed as being of very high potential impact.
When John realised the potential impact of Risk 3 materialising, he issued urgent advice to the board to withdraw from the activity that gave rise to Risk 3 being incurred. In the advice he said that the impact of Risk 3 was potentially enormous and it would be irresponsible for H&Z to continue to bear that risk.
The company commercial director, Jane Xylene, said that John Pentanol and his job at H&Z were unnecessary and that risk management was ‘very expensive for the benefits achieved’. She said that all risk managers do is to tell people what can’t be done and that they are pessimists by nature. She said she wanted to see entrepreneurial risk takers in H&Z and not risk managers who, she believed, tended to discourage enterprise.
John replied that it was his job to eliminate all of the highest risks at H&Z Company. He said that all risk was bad and needed to be eliminated if possible. If it couldn’t be eliminated, he said that it should be minimised.
(a) The risk manager has an important role to play in an organisation’s risk management.
Required:
(i) Describe the roles of a risk manager. (4 marks)
(ii) Assess John Pentanol’s understanding of his role. (4 marks)
(b) With reference to a risk assessment framework as appropriate, criticise John’s advice that H&Z should
withdraw from the activity that incurs Risk 3. (6 marks)
(c) Jane Xylene expressed a particular view about the value of risk management in H&Z Company. She also said that she wanted to see ‘entrepreneurial risk takers’.
Required:
(i) Define ‘entrepreneurial risk’ and explain why it is important to accept entrepreneurial risk in business
organisations; (4 marks)
(ii) Critically evaluate Jane Xylene’s view of risk management. (7 marks)
(a) (i) Roles of a risk managerProviding overall leadership, vision and direction, involving the establishment of risk management (RM) policies,establishing RM systems etc. Seeking opportunities for improvement or tightening of systems.Developing and promoting RM competences, systems, culture, procedures, protocols and patterns of behaviour. It isimportant to understand that risk management is as much about instituting and embedding risk systems as much asissuing written procedure. The systems must be capable of accurate risk assessment which seem not to be the case atH&Z as he didn’t account for variables other than impact/hazard.Reporting on the above to management and risk committee as appropriate. Reporting information should be in a formable to be used for the generation of external reporting as necessary. John’s issuing of ‘advice’ will usually be less usefulthan full reporting information containing all of the information necessary for management to decide on risk policy.
Ensuring compliance with relevant codes, regulations, statutes, etc. This may be at national level (e.g. Sarbanes Oxley)or it may be industry specific. Banks, oil, mining and some parts of the tourism industry, for example, all have internalrisk rules that risk managers are required to comply with.[Tutorial note: do not reward bullet lists. Study texts both use lists but question says ‘describe’.](ii) John Pentanol’s understanding of his roleJohn appears to misunderstand the role of a risk manager in four ways.Whereas the establishment of RM policies is usually the most important first step in risk management, John launchedstraight into detailed risk assessments (as he saw it). It is much more important, initially, to gain an understanding ofthe business, its strategies, controls and risk exposures. The assessment comes once the policy has been put in place.It is important for the risk manager to report fully on the risks in the organisation and John’s issuing of ‘advice’ will usuallybe less useful than full reporting information. Full reporting would contain all of the information necessary formanagement to decide on risk policy.He told Jane Xylene that his role as risk manager involved eliminating ‘all of the highest risks at H&Z Company’ whichis an incorrect view. Jane Xylene was correct to say that entrepreneurial risk was important, for example.The risk manager is an operational role in a company such as H&Z Company and it will usually be up to seniormanagement to decide on important matters such as withdrawal from risky activities. John was being presumptuousand overstepping his role in issuing advice on withdrawal from Risk 3. It is his job to report on risks to seniormanagement and for them to make such decisions based on the information he provides.
(b) Criticise John’s adviceThe advice is based on an incomplete and flawed risk assessment. Most simple risk assessment frameworks comprise at leasttwo variables of which impact or hazard is only one. The other key variable is probability. Risk impact has to be weighedagainst probability and the fact that a risk has a high potential impact does not mean the risk should be avoided as long asthe probability is within acceptable limits. It is the weighted combination of hazard/impact and probability that forms the basisfor meaningful risk assessment.John appears to be very certain of his impact assessments but the case does not tell us on what information the assessmentis made. It is important to recognise that ‘hard’ data is very difficult to obtain on both impact and probability. Both measuresare often made with a degree of assumption and absolute measures such as John’s ranking of Risks 1, 2 and 3 are not asstraightforward as he suggests.John also overlooks a key strategic reason for H&Z bearing the risks in the first place, which is the return achievable by thebearing of risk. Every investment and business strategy carries a degree of risk and this must be weighed against the financialreturn that can be expected by the bearing of the risk.(c) (i) Define ‘entrepreneurial risk’Entrepreneurial risk is the necessary risk associated with any new business venture or opportunity. It is most clearly seenin entrepreneurial business activity, hence its name. In ‘Ansoff’ terms, entrepreneurial risk is expressed in terms of theunknowns of the market/customer reception of a new venture or of product uncertainties, for example product design,construction, etc. There is also entrepreneurial risk in uncertainties concerning the competences and skills of theentrepreneurs themselves.Entrepreneurial risk is necessary, as Jane Xylene suggested, because it is from taking these risks that businessopportunities arise. The fact that the opportunity may not be as hoped does not mean it should not be pursued. Anynew product, new market development or new activity is a potential source of entrepreneurial risk but these are also thesources of future revenue streams and hence growth in company value.
(ii) Critically evaluate Jane Xylene’s view of risk managementThere are a number of arguments against risk management in general. These arguments apply against the totality of riskmanagement and also of the employment of inappropriate risk measures.There is a cost associated with all elements of risk management which must obviously be borne by the company.Disruption to normal organisational practices and procedures as risk systems are complied with.Slowing (introducing friction to) the seizing of new business opportunities or the development of internal systems as theyare scrutinised for risk.‘STOP’ errors can occur as a result of risk management systems where a practice or opportunity has been stopped onthe grounds of its risk when it should have been allowed to proceed. This may be the case with Risk 3 in the case.(Contrast with ‘GO’ errors which are the opposite of STOP errors.)There are also arguments for risk management people and systems in H&Z. The most obvious benefit is that an effectiverisk system identifies those risks that could detract from the achievements of the company’s strategic objectives. In thisrespect, it can prevent costly mistakes by advising against those actions that may lose the company value. It also hasthe effect of reassuring investors and capital markets that the company is aware of and is in the process of managingits risks. Where relevant, risk management is necessary for compliance with codes, listing rules or statutory instruments.