(upbeat percussion music)
-: There are 11 key principles
that underpin effective risk management processes
that are provided in the
Australian New Zealand Risk Management Standard
AS/NZS 31000.
It was in the 2009 version of the Standard
that the definition of risk was changed
from the chance of something happening
that can impact objectives
to the effect of uncertainty on objectives.
But what does this mean?
This means that there is now more focus
on the actual potential outcomes of uncertainty
rather than just the chance of it occurring.
This is because uncertainty
is inherent in business decisions
and it is therefore more important
to focus on the consequences or effects
rather than just that something could happen.
The Standard outlines 11 key principles
that are important to set behind risk management,
its processes, and framework
in order for it to be effective.
Have a think about what might happen
if every decision involving risk
requires the completion of a stack of paperwork
and a checklist that must have everything ticked off.
This will make the risk management process very inefficient
and is unlikely to assist the organisation
in creating value.
And although the process is designed to protect value,
because it is such a laborious task,
it may be completely ignored
or responses falsified.
This can result in risk
that should be managed not being managed
and can actually destroy value.
Therefore, it is important that risk management
contributes to the creation
and protection of value for the organisation.
That is, that it should help the organisation
to achieve its objectives
and not be too much of an administrative burden
such that it does not actually assist
with effective risk management.
If an organisation sets its strategy
to be a cost leader in its industry
and implements an outsourcing strategy
for a key import material
but does not consider the risks
associated with this before starting,
what could happen?
What we would find
is that the organisation
could face significant operational and financial risks
relating to the quality
and delivery of the material
and potential foreign exchange
or commodity price fluctuations.
If these are not considered
early in the planning process
then it is unlikely that actions
to reduce the likelihood of the risk occurring
or the severity of the consequences
will be put in place early enough
to be of much use.
Think about it this way,
if the supply contract
is transacted in U.S. dollars
and six months into the supply contract
the Australian dollar has weakened considerably
to 80 U.S. cents,
then taking action
to hedge against further drops in the dollar
will not be as effective
as if it had been done six months earlier
when the Australian dollar was stronger.
And a forward exchange contract
could have been entered into
at a rate of one Australian dollar
to 85 U.S. cents.
So we need to make sure
that risk management is not an afterthought.
It should form an integral part of both operational
and strategic level planning and activities.
And it should be a part
of decision making in the organisation.
Think about uncertainty.
It is inherent in many decisions
but can sometimes be overlooked.
For example, interest rates are currently low,
which enables many people
to take out large mortgages to buy property.
But if uncertainty relating to future interest rates
is not thought about and considered now,
then they may not be able
to meet the required payments in the future
if rates increase significantly.
Therefore, it is incredibly important
that an organisation clearly
and explicitly addresses this uncertainty
with respect to its objectives
for its risk management processes
to be truly effective.
The more clearly and explicitly
that uncertainty is identified and assessed,
the more likely it is
that the impacts can be controlled.
Consider an organisation
where there is no structured risk management process
and any potential risks
are identified and assessed in an ad hoc manner
and in many cases,
not considered at all
by those who do not believe risks are an issue.
By being systematic, structured, and timely,
an organization's risk management framework
would be more effective
as it will applied consistently across the organisation.
This also means that the risk management processes
are more efficient and information will be more reliable.
This is why the fifth principle
relates to risk management processes
being systematic, structured, and timely.
Consider that you are a chemist
working for a pharmaceutical company
and need to combine exact amounts of chemicals
to create medicines.
If you were to use a really old set of scales,
how likely is it
that your measurements would be accurate
and the product manufactured
exactly to required specifications?
This likewise applies when you're using information.
Risk management processes need to use
the best available information.
Using outdated or irrelevant data or information
will mean that your risk analysis
and therefore management
will not be as effective as it could be,
and worst case,
could result in poor decisions.
Let's think about if we were going to apply
a risk mitigation strategy
from an accounting firm
to a construction company
building a 30 story apartment complex.
Do you think that the risks and the controls
used by the accounting firm
would be useful for the construction company?
Is it possible that anything
really important could be missed?
So, it is also very important
that an organization's risk management framework
is actually tailored to the organisation.
It needs to match the organization's risk profile.
There is not a lot of point
using a generic framework,
if the organisation is extremely risk averse
or happy to make riskier decisions
to increase potential benefits.
An organization's culture
is going to have a big impact
on how risks are identified
and managed in an organisation.
If we go back to the accounting firm,
you would expect that most people
will be rather risk averse
and likely to identify potential risks
and be diligent in implementing controls,
whereas on the construction site,
it is much more likely
that there will be tradespeople
who are not too fussed about risks,
don't identify them and potentially take shortcuts
that are much more risky.
Therefore, it is also important
that the risk management process
takes into account the organization's culture
and considers the people in the organisation.
Activities undertaken within an organisation
will almost always involve people
and culture will play a big role
in the way risk management occurs.
How likely do you think employees will be
to follow risk management processes
and understand them
if they're not told about them?
This is considering the extreme view
but if staff and other stakeholders
are not included in the process and kept informed,
then, one, they are unlikely to understand
what is required of them,
and two, if they do not feel included,
they are more likely
to ignore process requirements.
Furthermore, staff, particularly frontline staff,
can provide incredibly important insight.
They can help make risk management more effective.
So, the principle relating
to transparency and being inclusive
refers to the engagement of stakeholders
throughout the risk management process.
That is, that everyone is included in the process
and that the risk management methods used
and framework is transparent
and clear for any interested party
to view and understand.
If we think about what uncertainty inherently is,
it is constant changes.
Therefore, we need to ensure
that our risk management processes
are dynamic and able to change
with changes in the external or internal environment.
Part of this means
that they should be constantly reviewed
to ensure that processes and controls
are continuously improving.
This brings us to the last two principles,
that the risk management process should be flexible.
It should be able to change
as the environment and circumstances change
and it should also be responsive
if the risk appetite of the organisation
changes for any reason.
For example, if a bank sets a covenant on gearing levels.
And finally, you should never stop trying to improve.
This doesn't just refer
to your risk management framework and processes.
It means that risk management
as part of the organization's culture
should help with continuous improvement
in the organization's activities.
It is important that these principles
underpin any risk management processes,
framework, or strategy
to ensure that it is
as effective as it can be
and to help protect the organisation
from detrimental risks
and so that any beneficial risks
can be taken advantage of.