what is risk management

what is risk management

Understanding the Fundamentals of Risk Management

1. Introduction to Risk Management

Accounting is about recording past events in a company’s affairs; it’s history. Security is about the future; it’s tomorrow. Sure, we all understand the security concept to the extent of buying life insurance and maintaining good locks, but our practical understanding of security is much less than it could be. In many small and medium-sized enterprises (SME), the word risk still remains an overused buzz phrase that beckons an explanation with the response, “okay, you tell me how much risk I really have then!” So that’s what we’re going to discuss in this chapter. My objective in writing this chapter is to provide you with an understanding that principal security is about the protection of assets and not the absence of danger. And management of that protection effort is what we call ‘security risk management’, which, incidentally, has an environment of its very own.

To many of us, risk is hard to understand because it is something we can’t see, but danger is all too apparent. As an overriding principle, the primary risk in security is inadequate protection. Simply put, the more we do to protect an asset, the less the chances of a bad event equates to. It’s economics. It’s that fundamental. Over the years, I’ve developed a theoretical understanding of the laws of security protection that are precisely the opposite of the laws of accounting. That is because security is a play on the future and, in general, accounting is a play on past events.

2. Key Concepts and Terminologies in Risk Management

In risk analysis, we often need to calculate expected values: the expected value of a random quantity V is the quantity that we expect to observe if we averaged V over many repeated measurements. It is also called the expectation or the mean. A natural concept in risk analysis is that of the expected risk exposure, which is the expected value of the risk’s conditional magnitude whenever it occurs. The expected risk exposure allows managers to compare the risks of adverse events with different types and magnitudes of harm. For complex systems, due to the lack of quantitative information about the shape of the tail of the conditional harm’s distribution, point estimates of expected risk exposures can result in biased risk assessments. We can use the idea of standard deviation to tell us the mean and a measure of the spread of a distribution. The probability is used to specify the chance that a particular outcome will occur.

Risk Exposure: This concept refers to a system’s risk and is defined as the product of the risk’s magnitude and the risk’s probability.

Risk: It is the event’s probability and the expected magnitude of loss, conditional on occurrence.

Mostly, a hazard is a chance of danger or risk; it is a source or situation that potentially brings harm, while risk is the probability of suffering loss over some unit of time. This connection can be disentangled via the concept of an event or function of certain variables leading to harm. Events correspond to well-defined outcomes or incidents occurring within a specified time window.

Hazard: A situation or activity that can result in an adverse event’s occurrence. Its physical attributes or potentialities may represent special dangers. It is the state that should be avoided or minimized in order to prevent harm. Hazard is a necessary precursor of harm.

2.1 Some Common Risk Management and Analysis Terminology:

This section explores various concepts and terminologies specific to risk management and analysis such as hazard, risk, and risk exposure; the use of expected values; and expected risk exposure, standard deviation, and probability. It also examines the Weibull probability distribution and its applications to engineering systems reliability.

3. The Importance of Risk Management in Various Sectors

For commercial businesses, the level of risk-taking and the form of the risk management can be the responsibility of the owners or of managers that report to them. The specific risk management activities can be divided up into enterprise risk management, accounting risk and financial risk management, financial and regulatory risk management, and catastrophe risk management.

The common principles include the observation that the more risk is taken, the higher the potential future rewards, but the heightened potential future losses indicate that risk needs to be priced into the product. An important challenge for all of these activities is the identification of risk without an overinvestment in controlling it in the short term.

Examples of these sectors include those engaged in property and casualty insurance, life insurance, banking, health care, crop insurance, and pensions. There are several principles that are common to each sector, but there are also important differences in risk measurements, risk pricing, and risk management activities. There are also differing tax treatments (if any) for risks assumed and risk management.

Risk varies across sectors, and each sector needs to take different approaches to the management of risk. This is particularly evident in those sectors that are affected by both actuarial risk (risks that can be priced and financed) and catastrophic risks (risks that can’t necessarily be financially dealt with as each occurrence tends to be large relative to the operator’s capacity to absorb the potential loss).

4. Risk Management Strategies and Techniques

It is frequently said that one cannot manage something unless it is measured. Although risk is difficult to quantify, portfolio managers make decisions within the framework of expected levels of risk and return, and they use analytical techniques that attempt to measure and estimate statistically the distribution of potential outcomes. Some of the techniques for evaluating portfolio risk are drawn from various statistical tests, and some are developed in the context of the investment process. But no matter how risk management processes work, the goal is to allow investment objectives to be achieved within the constraints placed on risk. Risk versus return is not a series of integers that are observed at stated points in time. It is a continuous distribution of potential outcomes that are generated by an investment strategy. And the uncertainty characterizing the outcomes is the risk taken by the investor.

There are a variety of strategic and tactical investment processes and techniques commonly used for managing portfolio risk. These strategies serve the purpose of determining how the asset mix and investment policy can be constructed, managed, and controlled. It is important to keep in mind that the technique selected must be consistent with investment return objectives and constraints. Tools and techniques alone do not provide security against potential losses. Every skillful and informed approach to risk management and control can only add some form of cost or security against worst-case scenarios. It is the combination of proper expectation formation, security selection, and implementation that rules the day.

5. Case Studies and Best Practices in Risk Management

Case examples of typical good risk management might include: the use of derivatives by a corporation which is faced with, say, dematerialization of its shares, an acquisition, or a desire to reduce shareholder funds in the face of stock market pressures. This corporation might choose to address the change in levels and to assert the barter nature of the transaction rather than hide or be embarrassed by change. The prudent corporation then makes certain that the change it believes in is reflected in the public domain: the derivatives that it has entered into for commercial purposes will then not have to appear on the balance sheet. The corporation will feel confident that the market—and the stock market—will applaud, understand, and value the corporation at what it would always have been worth through the use—under safe controls—of certain financial engineering practices.

The following case studies constitute a high-level array of what we would like to depict in this section as best practice in risk management. As noted, these case studies aim to illustrate how, and by whom, different components of good risk management may be achieved. In isolation, of course, they are unlikely to represent a panacea. It is crucial to manage risk in a dynamic fashion and to remember that even best practice today should be reviewed regularly in case it represents only a shadow of what may be needed tomorrow.