SAMPLE MATERIAL. Pathways Plus. Strategic Management and Leadership. Level 7. Unit 7022 Strategic Risk Management

Transcription

1 Pathways Plus Strategic Management and Leadership Level 7 Unit 7022 Strategic Risk Management

2 Pathways Plus Unit 7022: Strategic Risk Management Copyright Chartered Management Institute, Management House, Cottingham Road, Corby, Northants NN17 1TT. First edition 2010 Author: John Lambert Consultants: Peter Cumpstey and Peter Adlington Series consultants: Roger Merritt Associates Project manager: Trevor Weston Editor: Suzanne Pattinson Page layout by: Decent Typesetting British Library Cataloguing-in-Publication Data. A CIP catalogue record for this publication is available from the British Library. ISBN All rights reserved, save as set out below. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the written permission of the copyright holder except in accordance with the provisions of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency Ltd, 90 Tottenham Court Road, London, England WIT 4LP. Applications for the copyright holder s written permission to reproduce any part of this publication should be addressed to the publisher. Permissions may be sought directly from the Chartered Management Institute in Corby, UK. Phone Publications on (+44) (0) , or [email protected]. This publication is sold subject to the condition that it shall not, by way of trade or otherwise, be lent, re-sold, hired out, or otherwise circulated without the publisher s prior consent in any form of binding or cover other than that in which it is published and without a similar condition being imposed on the subsequent purchaser. Approved centres may purchase a licence from the publisher, enabling PDF files of the publication to be printed or otherwise distributed solely within the centre for teacher and student use only according to the terms and conditions of the licence. Further information is available on the licence from the Chartered Management Institute. Phone (+44) (0) , or [email protected]. Every effort has been made to trace holders of copyright material reproduced here. In cases where this has been unsuccessful or if any have inadvertently been overlooked, the publishers will be pleased to address this at the first opportunity. The publishers would like to thank the following for permission to reproduce copyright material: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) for ERM Framework on p.63; COSO, Enterprise Risk Management Integrated Framework: Executive Summary, 2004, Copyright 2004, All rights reserved. International Organization for Standardization for ISO 31000:2009: Risk Management Principles and Guidelines and ISO Guide 73:2009: Risk Management Vocabulary for Principles for managing risk on p. 66; Figure 2.2a on p.67, Components of the framework for managing risk ; Figure 2.2b on p.68, Risk management process ; and usefulness of a consultative approach on p.105. Boroondara, City of Harmony for its Boroondara Risk Management Strategy on p.53. Ortwin Renn for Table 3.2a on p.45, Overview of risk management strategies. Futron Corporation for Futron s risk management implementation roadmap (first column) on p.59. Patrick Ow for Figure 1.1b on p.55, Embedding risk management enterprise wide. Douglas Hubbard for Figure 1.2a on p.85, Cumulative probability chart for making a profit with a new product. Neil Allan for Figure 3.1a on p.40, Vulnerability map: construction industry. Harvard Business Review for table on p.28, Strategic risks; flow diagram on p.28, Six-step process to managing strategic risks ; table on p.92, Counter-measures for strategic risk ; all adapted from Slywotzky, Adrian J., and Drzik, John, Countering the biggest risk of all, April 2005, pp , Vol 83, No 4 2

3 OCEG for Figure 2.4a on p.71, Integrated components of the GRC capability model. Tilden Watson of Zurich Risk Engineering, for Figure 1.1a: Corporate risk profile for Kettering Borough Council, Sept 2009, on p.54 McGraw-Hill Professional for the extract on p.35 from Michael Durbin, All About Derivatives: The Easy Way to Get Started, (2005). Derbyshire County Council for an extract of their Risk Management Strategy, April 2009, on p.54. Penguin Books Ltd for the table on p.41, Two Ways to Approach Randomness adapted from Nassim Nicholas Taleb, The Black Swan (2008) Copyright Nassim Nicholas Taleb,

4 4

5 Contents About Pathways Plus... 7 Introduction Section 1 Concepts of risk, strategic risk and strategic risk management Topic 1: The problem of risk Risk concepts and conundrums Risk and decision making Topic 2: Managing strategic risks Types of strategic risk Six steps to managing strategic risks Corporate financial risk Topic 3: Approaches to managing risk strategically Managing the irrational in organisational risk management Managing complexity, uncertainty and ambiguity Dynamic risk management Section summary Section 2 The risk management framework Topic 1: Ingredients of the risk management framework The risk management strategy The risk management policy The risk management plan Topic 2: Models of strategic risk management The ERM approach IS :2009 standards The M_o_R framework The GRC capability model Section summary

6 Section 3 Risk management processes: assessment and treatment Topic 1: Evaluating risk assessment techniques Risk identification Risk analysis Risk evaluation Topic 2: Developing risk treatment strategies Types of risk treatment strategies Choosing risk treatment strategies The risk treatment plan Section summary Section 4 Other risk management processes Topic 1: Resourcing and communication Resourcing risk management strategies Establishing communication, consultation and reporting mechanisms Topic 2: Evaluating strategic risk management Aspects of strategic risk management evaluation An assessment tool for strategic risk management Improving strategic risk management Topic 3: Planning for disaster Business impact analysis Devising a disaster recovery plan Reviewing the disaster recovery plan Section summary Further reading Before you move on Preparing for assessment The Management and Leadership Standards

7 About Pathways Plus Development guides There are 15 development guides in the Pathways Plus series to cover the 17 of the units of the qualifications at CMI Level 7: Strategic Management and Leadership Personal Development as a Strategic Manager (ISBN: ) 7002 Strategic Performance Management (ISBN: ) 7003 Financial Management (ISBN: ) 7004 Strategic Information Management (ISBN: ) 7005 Conducting a Strategic Management Project (ISBN: X) 7006/ 7011 Organisational Direction and Strategic Planning (ISBN: ) 7007 Financial Planning (ISBN: ) 7008 Strategic Marketing (ISBN: ) 7009 Strategic Project Management (ISBN: ) 7010 Organisational Change (ISBN: ) 7012 Human Resource Planning (ISBN: ) 7013/ 7014 Being a Strategic Leader and Strategic Leadership Practice (ISBN: ) 7021 Introduction to Strategic Management and Leadership (ISBN: ) 7022 Strategic Risk Management (ISBN: ) 7023 Strategic Corporate Social Responsibility (ISBN: ) For further details on the development guides: Phone: (+44) (0) Fax: (+44) (0) [email protected] 7

8 Strategic Risk Management Qualification structure There are three qualifications available: CMI Level 7 Award in Strategic Management and Leadership Candidates need to complete any combination of units to a minimum of 6 credits to achieve the qualification. CMI Level 7 Certificate in Strategic Management and Leadership Candidates need to complete any combination of units to a minimum of 13 credits to achieve the qualification. CMI Level 7 Diploma in Strategic Management and Leadership Candidates need to complete all core units (Group A) and three optional units (Group B) to a total of at least 66 credits to achieve the qualification. Units Group A Unit 7001 Personal Development as a Strategic Manager Credit Unit 7002 Strategic Performance Management 7 Unit 7003 Financial Management 7 Unit 7004 Strategic Information Management 9 Unit 7005 Conducting a Strategic Management Project 10 Unit 7006 Organisational Direction 9 Group B Unit 7007 Financial Planning 6 Unit 7008 Strategic Marketing 6 Unit 7009 Strategic Project Management 6 Unit 7010 Organisational Change 7 Unit 7011 Strategic Planning 9 Unit 7012 Human Resource Planning 8 Unit 7013 Being a Strategic Leader 7 Unit 7014 Strategic Leadership Practice 7 Unit 7021 Introduction to Strategic Management and Leadership Unit 7022 Strategic Risk Management 9 Unit 7023 Strategic Corporate Social Responsibility

9 About Pathways Plus SR How to use the development guides The development guides provide a critical commentary to the ideas of writers and thinkers in the management and leadership field. They offer opportunities for you to investigate and apply these ideas within your working environment and job role. Structure Each guide is divided into sections that together cover the knowledge and understanding required for the equivalent unit or units of the Chartered Management Institute Level 7 Strategic Management and Leadership qualifications. Each section starts with a clear set of objectives linked to the learning outcomes of the qualification. You don t have to complete the sections in the order they appear in the guide (the mind map at the beginning of each guide will help you decide which sections and topics are of particular need or interest) but you should try to cover all sections if you are aiming for a full diploma qualification. Activities Throughout the guides there are activities for you to complete. These activities are designed to help you reflect on your own situation and apply your research to your organisation. Space and tables are provided within the activities for you to enter your own thoughts or findings, but in some cases you may choose to copy out the table or make notes in a separate notebook. Timings Timings are suggested for each activity to give you a rough idea of how long you should devote to them. They re not hard and fast, and you must decide whether you will benefit from spending longer on some activities than stated. Supporting resources The text of the guides is designed to provide you with an introduction to the subject and a commentary on some of the key issues, models and thinkers in the field. The activities are there to help provide a framework for your thinking. A key component of Pathways Plus (Pathways Plus because the development guides work together with the online supporting resources to provide an overall learning journey) is the list of references given throughout the text and at the end of each topic guiding you to the most appropriate supporting resources for you to explore yourself. These are marked with the symbol SR (as shown above). You have the opportunity to select those resources that are of most interest or relevance to you and to use them as a source of guided research on a particular topic. Many of the supporting resources are immediately available by logging into CMI s online 9

10 Strategic Risk Management P+ Study Resources ( and clicking on the Pathways Plus icon in the qualifications list, or the CMI online management and leadership portal, ManagementDirect (MDir), where you work for an organisation that subscribes to this service whichever you have access to. These resources are marked in the reference list at the end of each topic with P+ standing for Pathways Plus. A button on the first page of the site (whether Study Resource or MDir) will take you straight to the list of supporting resources as listed in the Pathways Plus topics. When there, click on the title of your development guide, the section and the topic you re interested in and then click straight to the article, video, podcast, checklist, extract or report that you want to find. For those resources that are not available through the CMI site, you will be directed to other sources (some also online) to reach what you need. Preparing for assessment Further information on assessment is available in the Student Guide produced as part of the Pathways Plus series. If you have any further questions about assessment procedures, it s important that you resolve these with your tutor or centre coordinator as soon as possible. Further reading You will find suggestions for further reading at the end of this guide as well as in the Study Resources section of the Institute s website at Alternatively, [email protected] or telephone

11 Introduction Welcome to this development guide on strategic risk management, which focuses on the content of the specification for Unit 7022 Strategic Risk Management. In Section 1, you will get to grips with some of the key concepts of risk, strategic risk and strategic risk management. This includes understanding the connection between risk and uncertainty and the concept of unforeseeable risks. You will also look at how flaws in our decision making can exacerbate risk. The second part covers the types of strategic and financial risks the organisation faces and how to deal with them. Then, finally in this section, you will consider three approaches to strategic risk management that go beyond the normal rational approach. Section 2 focuses on the overall framework of risk management in the organisation. You will consider three generic ingredients of the framework the risk management strategy, policy and implementation plan and then go through four overarching models for organisational risk management: the ERM approach, the ISO 31000:2009 standards, the M_o_R framework and the GRC capability model. Section 3 covers the two key risk management processes of risk assessment and risk treatment. The emphasis will be on evaluating risk identification and risk analysis techniques, with special attention given to the Monte Carlo simulation as opposed to the more popular but less quantitative likelihood consequence matrix. Risk treatment focuses on the four main strategies for risk treatment and developing a risk treatment plan. In Section 4 you will consider four other key risk management processes: resourcing, communication, evaluation/review and planning for disaster. This includes various strategies for resourcing, the various mechanisms for communication, consultation and reporting, using an assessment tool for strategic risk management, and the role of business impact analysis (BIA) and the disaster recovery plan in planning for disaster. 11

12 Strategic Risk Management Development guide mind map Section 1: Concepts of risk, strategic risk and strategic risk management Section 2: The risk management framework Assessment Strategic Risk Management Section 4: Other risk management processes If you are studying for the Level 7 in Strategic Management and Leadership qualifications you will be assessed by your approved centre on your knowledge and understanding of the following learning outcomes: Unit 7022: Strategic risk management Section 3: Risk management processes: assessment and treatment 1 Be able to understand the concept of risk, roles and responsibilities for risk management, and risk management tools and models 2 Be able to understand the resourcing and implementation of risk management strategy 3 Be able to understand the evaluation and management of risk management strategies 12

13 Section 1 Concepts of risk, strategic risk and strategic risk management Introduction This section aims to challenge your thinking on risk within the context of strategic risk management. You will consider some basic concepts of risk and risk management in Topic 1, then turn to strategic risk and strategic risk management in the other topics. You will consider the management of strategic risks in Topic 2 and, in Topic 3, three different approaches to managing risk strategically that take into account cognitive, uncertain and change factors. Learning outcomes This section covers the first part (the concept of risk) of the following learning outcome: Be able to understand the concept of risk, roles and responsibilities for risk management, and risk management tools and models 13

14 Strategic Risk Management Section mind map There are three topics in this section as shown below. Check the subjects within each one and then continue with the areas you need to explore. 1.1 Risk concepts and conundrums 1.2 Risk and decision making 3.1 Managing the irrational in organisational risk management Topic 1: The problem of risk 3.2 Managing complexity, uncertainty and ambiguity Section 1: Concepts of risk, strategic risk and strategic risk management Topic 3: Approaches to managing risk strategically Topic 2: Managing strategic risks 3.3 Dynamic risk management 2.1 Types of strategic risks 2.3 Corporate financial risk 2.2 Six steps to managing strategic risks 14

15 Section 1 Concepts of risk, strategic risk and strategic risk management Topic 1: The problem of risk Introduction In this topic you will look at risk as a problem. The problem is twofold: risk is a slippery customer because it s linked to uncertainty, so how can you pin down uncertainty? We all tend to approach and deal with risks in different ways, so how can we know we re managing it objectively? As part of this topic, you will discover some definitions of risk and risk management. 1.1 Risk concepts and conundrums You ve got to go out on a limb sometimes because that s where the fruit is. What is risk? Will Rogers The Oxford English Dictionary defines a risk as a situation involving exposure to danger, while The American Heritage Dictionary of the English Language, along the same lines, mentions the possibility of suffering harm or loss. A Guide to the Project Management Body of Knowledge (PMBOK Guide), however, defines (project) risk as an uncertain event or condition that, if it occurs, has a positive or negative effect on at least one project objective. In a similar way, the UK Office of Government Commerce defines risk in its M_o_R framework as an uncertain event or set of events which, should it occur, will have an effect on the achievement of objectives. A risk consists of a combination of the probability of a perceived threat or opportunity occurring and the magnitude of its impact on objectives. The above definitions contain within them the key ideas in our understanding of risk: danger/loss uncertainty reward. SR 1 Douglas Hubbard, however, takes exception to the PMBOK and M_o_R definitions because, by using, respectively, the words positive and opportunity, they imply that risk could be a good thing. His point is that risk in itself is always about something bad that may happen. On the other hand, if something good happens from a decision that involves uncertainty, then this is not a risk event or negative outcome but an opportunity event or positive outcome. Accordingly, when we attempt to measure risk, we are always measuring the downside of decision making, (harm, losses) and not the upside. Hence his definition of risk is: 15