A. Enterprise Risk Flashcards
(112 cards)
1
Q
what is risk?
A
condition in which there exists a quantifiable dispersion in the possible outcomes from any activity
the combination of the probability of an event and its consequences
risk in business is the chance that future events or results may not be as expected
2
Q
what are downside/upside risks?
A
downside: purely bad, adverse outcome
upside: results better than expected, favourable outcome
3
Q
what is two way risk?
A
sometimes called speculative risk
actual result could be better or worse than forecast
4
Q
what is uncertainty?
A
arises from ignorance and a lack of information
5
Q
why incur risk?
A
- INCREASE FINANCIAL RETURN:firms must be willing to take higher risks if they want to achieve higher returns
- TO GAIN COMPETITIVE ADVANTAGE:generate higher returns a business may have to take more risk in order to be competitive
- generate more market share
6
Q
what are the benefits of taking risks?
A
not limiting its activities or providing little or no competitive advantage
7
Q
What are the following risks?
- political
- legal/litigation
- regulatory
- compliance
A
- political:due to political instability, external
- legal/litigation:legal action against business
- regulatory:changes in regulation affecting business
- compliance:non-congruence with the law resulting in fines/penalties
8
Q
what are business risks?
A
strategic product commodity price product reputation operational contractural inadequacy fraud and employee malfeasance:
9
Q
what are the following risks?
- strategic
- product
- commodity price
- product reputation
- operational
- contractural inadequacy
A
- strategic:business strategies will fail
- product:failure of new products or loss of interest in existing products
- commodity price:rise in commodity prices
- product reputation:change in a product’s reputation or image
- operational:business operations may be inefficient or business changes may fail
- contractural inadequacy:terms of a contract do not fully cover a business against all potential outcomes
10
Q
what is economic risk?
A
changes in the economy an affect business
e.g.inflation, unemployment rates, international trade relations
11
Q
what were the 6 contributing factors to the credit crunch?
A
- US sub-prime mortgage lending
- CDOs. i.e collateralised debt obligations
- Debt rating organisations
- Banks’ financial structure
- Credit default swaps
- Risk takers
12
Q
what were the 5 implications of the credit crunch?
A
- the collapse of major financial institutions
- the credit crunch
- government intervention
- recession and ‘austerity measures’
- problems refinancing government debt
13
Q
describe US sub-prime mortgages contributing factor
A
low interest rates to stimulate growth
relaxed mortgage criteria
-sub-prime mortgages’ for those even with high default risk and taking out adjustable rates
1/5 in 2005 were sub prime
inflationary pressure caused interest rates to rise
mortgage owners pay higher rate and leads to defaults
boom in house prices came to an end and house prices started falling
14
Q
describe CDO contributing factor
A
selling on debt in the form of CDOs
insurance for mortgage companies
others shared risk of SPM
3 tier structure:
Tier 1: senior or investment grade which is low risk but with a low return
Tier 2: mezzanine tranche medium risk and return
Tier 3: equity tranche with highest risk and return
money received on mortgages used to pay tier 1 bond holders meaning less left for 2 and 3, with 3 suffering first and creating a waterfall effect
15
Q
describe debt rating organisations contributing factor
A
CDO bonds credit rates for risk
lack of understanding or too much faith in purchasers
allocated low risk credit rating giving people confidence in investing
regulatory failure
16
Q
describe bank’s financial structure as a contributing factor
A
banks are highly geared with less than 10% of asset value covered by equity
loss in asset value can wipe out equity account
banks found themselves in a position with negative equity
17
Q
describe bank’s credit default swaps as a contributing factor
A
alternative to CDOs
lenders could purchase insurance on sub-prime debt through credit default swaps or CDSs
these purchases were first to suffer when default levels increased
18
Q
describe risk takers as a contributing factor
A
taking risks they didn’t understand
19
Q
Describe the implication of collapse of major financial institutions due to the credit crunch
A
some very large financial institutions went bust and got into serious trouble thus needing bailouts:
- Lehman Brothers biggest bankruptcy in history
- government put together $85bn bailout for AIG
- BOE lent Northern Rock £27bn in collapse
20
Q
Describe the implication of the credit crunch
A
banks couldn’t raise sufficient finance
lots of bad debt and low confidence
banks became reluctant to lend leading to liquidity on money markets
harder to refinance loans causing major problems
21
Q
Describe the implication of government intervention
A
governments felt compelled to intervene and inject money for liquidity purposes
used a mixture of loans, guarantees and the purchase of equity
central banks tried to raise the amount of lending by cutting interest rates but if they’re too low have to resort to QE
Feb2020: QE programme that cost £200bn
many governments found themselves with huge levels of debt with the corresponding need to repay high levels of interest as well as repay the debt
22
Q
what is quantitative easing?
A
CB buys assets using financial assets such as government and corporate bongs using money it has created out of thin air
the institutions selling these assets will have increased liquidity thus boosting money supply
23
Q
Describe the implication of recession and ‘austerity measures’
A
credit crunch implications lead to a recession in many countries
fall in taxes but raise in govt spending so need to cut back on spending to avoid higher levels of national debt
24
Q
Describe the implication of problems refinancing government debt?
A
In 2010/2011 some countries tried to refinance national debt by issuing bonds:
- Spanish government needed to raise more borrowing as debts reached maturity, also needed to cut spending which affected public sector and lead to tax hikes and pension freeze
- Greece government had shorter maturity period on bonds than countries like the UK
Other countries needed IMF bailout e.g Greece, UK and Ireland from the EU
25
What is financial risk?
risk of a change in a financial condition such as an exchange rate, interest rate, credit ration of a customer or price of a good
26
what are the main types of financial risk?
```
currency
political
credit
interest rate
gearing
```
27
```
explain the following financial risks:
currency
political
credit
interest rate
gearing
```
currency:fluctuation in exchange rate
political:arising from government actions
credit:non-payment by customers
interest rate:risk that interest rates change
gearing:in the way a business is financed (debt vs equity)
28
what is technology risk?
that technology changes will occur that either present new opportunities to businesses or on the down-side make their existing processes obsolete or inefficient
29
what is cyber risk?
risk of financial loss, disruption or damage to an organisation caused by issued with the information technology systems they use
30
what is environmental risk?
risk from changes in the environment e.g. natural disasters or climate change
31
for what type of companies is environmental risk an important factor?
when deciding policy premiums as they can severely alter the results of insurance businesses
32
what changes in the environment can affect environmental risk?
factors we can control e.g. oil spill, pollution
| factors we can't directly control e.g. climate change, global warming
33
what is reputation risk?
downside as the better the reputation of the business, the more risk there is of losing that reputation
34
what is fraud risk?
operational business risk
vulnerability of an organisation to fraud
need to have strong controls
controllable risk
35
what does the size of fraud risk depend on?
the probability of fraud occurring
| the size of the losses if fraud does occur
36
how can fraud risk be managed?
fraud prevention:ensuring that the opportunities to commit fraud are minimised
fraud detection and deterrence: identify fraud after it has occurred so employees deterred from performing fraud
37
what could cause corporate reputation risk?
environmental performance
social performance
health and safety performance
38
why is reputation risk harder to control?
some services outsourced e.g. clothing manufacturing so might not know enough about practices e.g. sweat shops
39
what is employee malfeasance risk?
doing wrong or committing and offence
- making false representations
- failing to comply with requirements
40
what are some risks from international operations?
```
culture
litigation
credit
items in transit
financial risks
```
41
```
what are the following international operations risks:
culture
litigation
credit
items in transit
financial risks
```
culture: culture clash, lack of local knowledge
litigation:may not understand legislation well so more risk of breaching it
credit:controlling credit risk in overseas operations, harder to chase debt
items in transit:damaged or lost in transit
financial risks:foreign exchange risks, interest rate risks
42
what is risk management?
the process of understanding and managing the risks that the organisation is inevitably subject to in attempting to achieve its corporate objectives
43
what is the traditional view of risk management?
avoid downside risk
44
what is the new approach of risk management?
benefiting from upside risk
45
what is ERM?
enterprise risk management is the term given to the alignment of risk management with business strategy and the embedding of a risk management culture into business operations
46
what are the key principles of ERM?
- consideration of RM in the context of business strategy
- RM is everyone's responsibility, with the tone set from the top
- the creation of a risk aware culture
- a comprehensive and holistic approach to RM
- consideration of a broad range of risks (strategic, financial, operational and compliance)
- a focused RM strategy, led by the board
47
what does the cube in the COSO ERM framework represent?
the relationships between objectives, components and different organisational levels
48
what do the 4 objectives represent?
the responsibility of different executives across the entity and address different needs
areas of responsibility
49
what do the 4 organisational levels emphasise?
the important of managing risks across the enterprise as a whole
50
what are the 8 compounds?
function effectively for risk management to be successful
51
what are the elements of effective internal control system?
the 8 elements that are components of managing risks
52
what is EY's model for shareholder value?
shareholder value = Static NPV of existing business model + value of future growth options
sum of the value of what a company does now and the value of what they could possible do in the future
53
what 4 stages does EY identify as risk management?
a) establish what shareholders value about the company
b) identify the risks around the key shareholder value drivers
c) determine the preferred treatment for the risks
d) communicate risk treatments to shareholders
54
how did COSO update the ERM framework in 2017?
double helix format as should be part of company DNA
rainbow colour to represent inclusivity
doesn't replace cube but shows change in business environment
55
what are the 5 components of the 2017 ERM framework?
governance and culture:internal environ and importance of tone of org
strategy and objective setting:main focus of update, emphasis of importance in making sure ERM is aligned to risk appetite
performance:combines cube
review and revision
information, communication and reporting
56
what are the benefits of ERM?
- enhanced decision making by integrating risks
- reduced performance fluctuations and fewer interruptions to operations
- the resultant improvement in investor confidence and hence shareholder value
- focus of management attention on the most significant risks
- a common language of risk management which is understood throughout the organisation enabling performance improvement
- increased ability to benefit from upside risk and reduced susceptibility to downside risk
- reduced cost of finance through effective management of risk
- improved utilisation of resources
- increased opportunities for the organisation
57
how was risk management strategy formed in the past?
left to individual managers to make assessments of the risks the business faced and exercise judgement on what was a reasonable level of risk
58
how is a risk management strategy formulated in modern times?
ensure the risk exposures of the organisations are consistent with its risk appetite. Should be sufficient to:
- review its internal control system and its adequacy at least annually
- ensure that controls are properly implemented
- monitor the implementation and effectiveness of controls
try to achieve required business objectives with the lowest possible chance of failure
59
what are some factors that affect the risk appetite?
```
nature of product being manufactures
the need to increase sales
the background of the board
amount of change in the market
reputation of the company
```
60
what are the features of a risk management strategy according to the IMA-IFAC joint report Enterprise Governance?
- statement of the organisation's ATTITUDE to risk - the balance between risk and the need to achieve objectives
- the risk APPETITE of the organisation
- the OBJECTIVES of the risk management strategy
- CULTURE of the organisation in relation to risk (and the behaviour the organisation expects from individuals with regard to risk-taking)
- responsibilities of managers for the application of risk management strategy
- reference should be made to the risk management SYSTEMS the company uses
- performance CRITERIA should be defined so that the effectiveness of risk management can be evaluated
61
what 3 elements are included in the Institute of Risk Management's risk management process?
1) risk assessment
2) risk reporting
3) risk treatment
62
who controls the risk identification process?
a risk committee or risk management specialists
63
what is a risk register?
list of all the risks that have been identified and the measures that have been taken to control each of them
management tool
takes days to produce and should be updated regularly, annually according to guidelines
64
In the tabular format, what are the headings in a risk register?
1) the risk title
2) the likelihood of the risk
3) the impact of the risk should it arise (scale of 1-5)
4) the risk owner's name
5) the date the risk was identified
6) the date risk was last considered
7) mitigation actions
8) overall risk rating
9) further actions
10) the action lead name will be detailed
11) a due date
12) risk level target
65
what are some quantitative techniques used to measure risk?
```
EVs and SD
volatility
VaR
regression analysis
simulation analysis
```
66
what is standard deviation?
measure of the dispersion of the possible values of a given factor from EV or mean
measure of volatility, higher value means greater risk involved
67
what does VaR show?
allows investors to assess the scale of the likely loss in their portfolio at a defined level of probability
most widely used measure of financial risk as investors care mainly about the probability of a large loss
68
what 3 components are needed for VaR?
a time period
a confidence level
a loss amount/percentage loss
69
what is Basel II?
established rigorous risk and capital management requirements to ensure each bank holds reserves sufficient to guard against its risk exposure, given its lending and investment practices
regulators require banks to measure their market risk using a risk measurement model which is used to calculate the VaR
70
what can a regression analysis be used to measure?
a company's exposure to several risk factors at the same time
71
how does regression analysis work?
regressing changes int he company's cash flows against the risk factors
regression coefficient will indicate the sensitivities of the company's cash flow to these risk factors
72
what is the drawback of regression analysis?
based on historical factors which may no longer be predictors of the company in the future
73
what is simulation analysis?
shoes sensitivity of values
mean and SD are then calculated from these results to give Ev and measure of risk
74
what is the drawback of simulation analysis?
complex and time-consuming to carry out and limited to assumptions of the probability distributions
75
what are some other methods of measuring or assessing the severity of an identified risk?
scenario planning
decision trees
sensitivity analysis - what if analysis
76
what are the drawbacks fo the quantification of risk?
once a risk has been quantifies, there is a problem:does anyone know what it means?
77
what is an assurance map?
a risk map
can help spot duplicates or burdensome assurance processes
helps prioritise risk
78
who is involved in preparing a risk map?
the Board, the Risk Committee, the Audit Committee and senior management from various departments
79
what are some risk treatment methods?
avoid risk
transfer risk e.g. insurance
pool risks e.g. centrally managed financial risk
diversification
80
what are the objectives of risk response objectives?
exposure to severe risks is minimised
unnecessary risks are avoided
appropriate measures of control are taken
the balance between risk and return is appropriate
81
what is backward integration?
development concerned with the inputs into the org
82
what is forward integration?
development into activities that are concerned with the organisation's outputs
83
what is horizontal integration?
development into activities that compete with or directly complement an organisation's present activities
84
what are the problems with diversification?
- if diversification works, why are there so few conglomerates?
- specialising can give competitive advantage
- difficult to excel in diversified business
- many orgs diversify their operations
- relatively little advantage accrues to the shareholders from diversification
85
what is hedging?
reducing risks by entering into transactions with opposite risk profiled to deliberately reduce the overall risks in a business operation or transaction
86
what is risk sharing?
reduce risk in a new business operation by sharing the risk with another party e.g. joint venture
87
how is risk viewed in the risk cube?
combination of threat, exploiting some vulnerability that could cause harm to an asset
88
what is residual risk a combined function of?
- a threat less the effect of threat-reducing safeguards
- a vulnerability less the effect of vulnerability-reducing safeguards
- an asset less the effect of asset value-reducing safeguards
89
how can risk be managed?
reduce the threat
reduce the vulnerability
reducing the asset value
90
what is ISO 31000?
a group of standards designed to provide guidance on risk management
comes from the International Organisation for Standardisation
91
what is the International Organisation for Standardisation?
independent non-government group
develops voluntary international standards which help facilitate international trade by providing confidence that an overseas organisation is working to an appropriate level
standards are related to a wide range of areas from quality, safety, reliability to cyber security and risk management i.e. open standards
92
what are the seven ways an organisation may choose to deal with risk according to the ISO31000 Standards?
similar to TARA but more detail:
Transfer
-sharing the risk
Avoid
-avoiding the risk
Reduce
- changing the probability
- changing the outcome
- removing the risk source
Accept
- accepting the risk
- retaining the risk
93
what does a risk reporting system include?
- a systematic review of the risk forecast
- a review of the risk strategy and responses to significant risks
- a monitoring and feedback loop on action taken and assessments of significant risks
- a system indicating material change to business circumstances to provide an 'early warning'
- the incorporation of audit work as part of the monitoring and information gathering process
94
what type of risks do risk reports show?
gross risk
| net risk
95
what is gross risk?
assessment of risk before the application of any controls, transfer or management responses
96
what is net (residual) risk?
assessment of risk, taking into account the controls, transfer and a management responses
97
if the residual risk is considered to be too great then the company will need to...
- not expose itself to the risk situation
| - put in place better controls over the risk
98
what is an approach to assessing the ability to bear a risk?
consider its financial consequences in relation to:
- the organisation's profits
- return on capital employed
- the organisation's expenditure budget
99
how do we know when the strategy has been successful?
targets included in risk management strategy met
| risk strategy objectives have been achieved
100
do the benefits of a risk management strategy outweigh the costs?
- perform CBA of controls
- benefits from risk controls should preferably be measured and quantified, although some benefits (such as protecting the company's reputation) might have to be assessed qualitatively
- the evaluation process should be based on the principle that the costs of a control measure should not exceed the benefits that it provides
101
how do risks interact?
identification is important because risks are often interrelated ie one risk is more likely or will have a more significant impact for an organisation
102
what are specific responsibilities of a board of directors in risk management?
ultimate responsibility for risk management
| define risk appetite
103
what are specific responsibilities of an audit committee in risk management?
responsible for reviewing internal control systems
| working with external/internal auditors
104
what are specific responsibilities of a risk committee in risk management?
direct responsibility for risk management
105
what are specific responsibilities of a risk management group in risk management?
report to the Board via audit/risk committees
group of senior and middle management with operational responsibility for carrying out the risk management process
identification of risks
106
what are specific responsibilities of an internal audit in risk management?
review of internal controls
| support management in risk management process
107
risk officer role?
assigned to each division who will help to identify and manage tactical and operational level risks
108
what are the main aims of a risk committee?
- raising risk awareness
- establishing policies for risk management
- ensuring that adequate and efficient processes are in place to identify, report and monitor risks
109
what are the secondary aims of the risk committee?
- advise board on risk profile and appetite
- acting on behalf of the board
- continual review of the risk policy
- ensuring that there are appropriate communication of risks
- ensuring that there are adequate training arrangements in place
- obtaining appropriate external advice to ensure that risk management processes are up to date
- ensuring that best practices in risk management are used by the company
110
what are the typical activities of the risk committee?
- provision of overall leadership for rm team
- identification and evaluation of risks
- implementation or risk mitigation strategies
- seeking opportunities to improve risk management
- monitoring the status of risk mitigation
- developing, implementing and managing risk management programmes
- maintaining good working relationships with the board
- ensuring compliance with any laws and regulations
- implementing a set of risk indicators and reports
- liaising with insurance companies
- depending on specific laws of the jurisdiction in which the organisation is based, working with external auditors
- depending on jurisdiction, abiding by SOX for stat reports
111
what are general responsibilities of all employees?
be aware of risks
| be audible
112
how was Northern Rock a case of failure in risk management?
failed to have enough reserves to cover liabilities
```
bank run (first in over 150 years in UK) lead to government providing 'lender of last resort' funding
fall in share price and credit rating
```
had a formal approach to risk management
however they assumed managers had unimpeded access to funds, causing more risk taking
shows need to move beyond tick-box approach to compliance and good governance required a more insightful approach to risk management and internal control
