session on ‘Process Overview and Risk Identification’.

COVID-19 has transformed the way businesses operate. Enterprise risk

management (ERM) is more critical now than it has ever been, as businesses

are pressured to implement readiness and business continuity strategies.

Although some businesses have had to make last-minute preparations in

order to keep the business going, the need to better evaluate emerging

threats is stronger than ever.

Risk management is an essential mechanism because it provides a company

with the resources that it needs to correctly identify and handle possible

risks. It is possible to overcome a risk only after it has been detected.

Furthermore, risk management provides a firm with a foundation on which to

make rational decisions.

Therefore, it is imperative to know how to identify, assess and manage risks.

In this session, we are aiming to do the same.

In this session
You will go through the entire risk management process in detail. You will

learn how to:

Identify risks that might be detrimental to an organisation,

Categorise risks into various groups, and

Collect risk data and prioritise risks accordingly.

Key Terminology
To have a better understanding of the process of risk management, there are

a few terms that you will need to have clarity on. Some terms that are

frequently used throughout the ERM process are explained in the video

provided below. Let's get you acquainted with them

learnt the key terms associated with enterprise risk management. The image
given below summarises your learnings from this video

Key Terminology
According to PwC, “Risk velocity measures how fast an exposure can impact an
organisation”.

A global sport-shoes-manufacturing company has a manufacturing plant in

Bangladesh. It is predicted that due to heavy rainfall in the next few days, the area is
likely to get flooded. These floods will hamper the manufacturing operations by
disrupting the supply chain.

Assume that you are on the risk management committee of this company. Based on
the information provided, how would you categorise the risk velocity of this event on a
scale ranging from low (risk manifests in a few years), medium (risk manifests in a few
months) to high (risk manifests in a few weeks)?

High

✓ Correct
Feedback:

Since heavy rainfall is expected in the next few days, the region would
subsequently get flooded, thus putting it in the category of high risk velocity.

Key Terminology
State whether the statement given below is true or false.
Inherent risk is always greater than residual risk

True

✓ Correct
Feedback:

Inherent risk is the risk that arises before any control measure is implemented,
and residual risk is the kind that remains after the implementation of such
measures. The control measures are supposed to reduce the risk level.

ERM Process: Overview

“One size does not fit all”

This statement applies to the ERM process. The risk management process is

never the same for two different organisations. However, the essence and

idea behind carrying out the process remains the same

the basic risk management process for any organisation will have the steps
listed below.

Additionally, this process is not carried out only once; it is a continuous

process. You need to keep going back to the basics to ensure that all the new
developments related to the risks faced by an organisation are taken into
account as and when they happen

Overview of the ERM Process

 How is the impact of mitigation strategies measured quantitatively?

Key performance indicators (KPIs)

✓ Correct
Feedback:

KPIs are the tangible metrics that are required to measure the impact of risk
mitigation strategies so that their effectiveness can be determined.

Overview of the ERM Process

Consider these statements:

1.
Back in 2016, Samsung formally recalled its Galaxy S7 smartphones due to a
manufacturing defect, drawing negative attention towards itself.

2.
Critics have shown confidence in the most recent Samsung smartphones, pushing
sales forward.

Which of these options is correct with regard to the two statements given above?

Ans: Statement I is an example of an aggravating factor, whereas Statement II

is an example of a mitigating factor.

✓ Correct
Feedback:

The constant news reports and negative reviews caused sales to drop. This is an
example of a reputation risk. Therefore, Statement I is an example of an
aggravating factor.
Later, when critics showed confidence in the brand, its sales increased.
Therefore, Statement II is an example of a mitigating factor.

Overview of the ERM Process

Hyundai Motors India Limited has two manufacturing plants in Tamil Nadu: one in
Irungattukottai and the other in Sriperumbudur.

Suppose you are a member of the enterprise risk management committee of Hyundai
Motors India Limited. Which of these events would you categorise as having a high
impact and low likelihood?

A tsunami on the east coast of India

✓ Correct
Feedback:

The chances of a tsunami occurring on the east coast are slim, i.e., it is a low-
likelihood event. However, if it ever occurs, then it would disrupt the supply chain
and day-to-day operations. This makes it a high-impact event.
 learnt about several sources of risk identification, such as strategic plan

evaluation, competition evaluation, carrying out industry research, analysing

data from trade publication and studying social media trends

However, the most typical sources of risk identification are group

brainstorming sessions, individual interviews, surveys and focus group

interviews.

It can be challenging for managers, including those whose primary

responsibility is to handle risk management, to have a complete picture of

the risk environment, particularly in larger organisations with numerous

divisions.

Experts suggest risk interviews to better understand the risks that an

organisation faces. When conducted correctly, risk interviews boost the ERM

process, one response at a time.

This raises the question of who should be interviewed to gain better insights

into the risks that an organisation might be facing

You saw that not all members that are interviewed are necessarily risk

experts. Therefore, it is important to prepare them beforehand to ensure that

they participate adequately in the meetings. This can be done through the

following:

Sending a risk memo

Laying out questions for them to think about, some examples of which are as

follows:


 What are the 3–5 things that ‘keeps you up at night’ about the risks of our

company, and why?

What would prevent us from achieving our objectives?

Describe a scenario of what could go wrong and how we would respond

today.

What controls are currently in place? What should be done better?

What risks should we consider over the next 12–18 months?

What risks will be important for our sustainability 10 years from now?

You also saw that these questions need to be answered by a variety of people.

They must belong to all the vertices or divisions of an organisation. Ideally,

there should be representatives from all the departments in the organisation,

including the ones mentioned below.

Risk Identification
In this segment, you learnt about the common practices for identifying risks

that organisations might face. You also saw that representatives from various

departments are needed to better identify the risks to the organisation.

However, as you learnt earlier, an organisation might face numerous risks,

which makes it essential to classify them into subcategories to aid the

decision-making process

Risk Identification
Which of the following is the purpose of a risk identification prep memo? (Note:
Multiple options may be correct.)

To make the members of the committee more responsive

✓ Correct
Feedback:

As discussed in the video, the people being interviewed are more responsive
once they have been given the memo and have had time to prepare.

To make the members better prepared for the interview or brainstorming

session

✓ Correct
Feedback:

Giving the people being interviewed a prep meo in advance allows them time to
prepare.
To make the members of the risk committee think from a risk perspective

✓ Correct
Feedback:

As discussed in the video, the people being interviewed think from a risk
perspective if they are given the prep meo in advance.

Risk Identification
An organisation has hired a consultant for its ERM process. The consultant wants to
take honest feedback from the senior management of the organisation, and to get a
better understanding of the present situation, she also feels that follow-up questions
may be required. What method of risk identification should she employ?

Individual interview

✓ Correct
Feedback:

The consultant wants to get a thorough understanding of the organisation’s

current scenario and honest feedback from managers and also wants to ask
follow-up questions. Individual interviews are the best way to accommodate
these requirements.

Risk Classification
For any organisation, at any given point in time, there exist multiple risks. It

would be difficult to study or track these risks individually. Therefore, risk

categorisation becomes imperative.

Risk categorisation provides a systemic and structured approach in

identifying the risks to a consistent level. Another benefit is that it provides

better management focus in identifying a wide range of risks.

It is not possible to create a one-size-fits-all risk category for all projects, as

different projects may be involved in different sources of risks and processes.

However, the risk management committee needs to create as many

categories as appropriate for labelling risks.

The most intriguing part about risks is their uncertainty. You cannot be
certain about the risks that an organisation might face in the future.
However, it will be incorrect to assume that leaders are totally in the dark
when it comes to recognising such risks. Their experience and knowledge
certainly can be employed to have a good, if not a 100% accurate, prediction
of the risks that an organisation might possibly face in the future.

video, you learnt about 'the one thing'.

Risk Classification

Risk Classification
In parts of Ethiopia, unrest has erupted as some ethnic groups are protesting against
government discrimination. Protesters are targeting foreign companies that are
believed to be receiving preferential treatment from the Ethiopian government. It is
widely speculated that the government will declare a state of emergency.

You are a member of the risk committee of a foreign firm that has operations in
Ethiopia. How would you categorise the risk that your organisation faces?

Geo-political risk

✓ Correct
Feedback:

Correct! This should be categorised as geo-political, as the risk is being posed by

an international political conflict

Session Summary
In the complete journey of learning about the entire process of enterprise

risk management, you learnt how to:



Identify risks that might be detrimental to an organisation,

Categorise risks into various groups, and

Collect risk data and prioritise risks accordingly.

Graded Assessments
Please note: The questions in this segment are graded and will contribute

towards your final score for the course.

Comprehension

Read the information given below and answer the questions that follow.

A car manufacturing company decides to make only minor changes to its

bestselling model, as it wants to stick to manufacturing what is already

popular. However, its competitors are continuously innovating and making

their cars better.

Competitor risk

✓ Correct
Feedback:

Correct! In a constantly changing market scenario, it is imperative for

organisations to keep innovating with the purpose of surviving the competition.
Choosing not to innovate would certainly give their competitors an extra edge.

One of the competitors believes that a high degree of innovation would improve its
sales. That company, therefore, tries to make as many changes as possible, even to
the features that were found the most pleasing by customers. This has also given rise
to certain quality issues.

What types of risks is this particular car-manufacturing company facing?

Innovation risk

✓ Correct
Feedback:

This is the correct option. Innovation risk is the risk of an innovation failing in the
market. Since the company has introduced several changes to the product and is
also witnessing certain quality issues, the product might not perform well in the
market.

Graded Assessments
A housing company has acquired a huge piece of land and is in the process of
constructing houses to sell later. This may have the potential to cause a crisis for the
company because until the houses are sold, all the investments will be locked up with
them. What type of risk is the housing company most likely to face?

Liquidity risk

✓ Correct
Feedback:

Correct! The land acquisition and the construction of houses needed a significant
investment by the company, but it will get paid only when the houses go up for
sale. Therefore, it will take time for the investments to get converted back into
cash.