Risk and manage risk
Conceptually, risk is any uncertainty that may be harmful to the
ability to successfully implement
the business
objectives of the enterprise. Businesses can identify potential
risks to manage them. Fully understood, risk management is a process of a
comprehensive review of the business operations to identify potential risks
that may impact adversely to the operational aspects of the business. Based on
that, the response solutions will be given corresponding to each risk. We can
also understand that the risk management process is a process that is organized
in a formal way and ongoing to determine, control and report the risks that can
affect the achievement of the business objectives of the enterprise.
Requirements for operational risk management
To ensure that
risk management activities
are carried out as planned, the implementation must ensure the following
requirements:
• Raising awareness about the risks as well as the ability to cope
with risks appropriately throughout the enterprise;
• Formalize the process of risk management;
• Develop unified risk management processes in the enterprise;
• Transparency risks;
• Including risk management process as part of the internal
control system;
In fact, well organized and efficient risk management activities
will contribute to add value to the enterprise, specifically:
• Help improving operational efficiency and create competitive
advantage;
• Contribute to the allocation and efficient use of corporate
resources;
• Minimize errors in all aspects of business operations…
Recently, with the powerful impact of high inflation rate and
economic recession caused by the global financial crisis to enterprises, people
are concerning more about risk management activities. Many experts believe that
well organized and effective operated risk management system will help
businesses withstand and overcome fluctuations.
However, how to organize a complete risk management system is the
fact that not many businesses are well understood. The worrying thing is many
businesses supposing that with the use of insurance services, their businesses
are making adequate risk management. That is completely incorrect.
Risk management policies and implementation
To establish
risk management systems, enterprises should start from the
development of risk management policy. This policy will define the approaching
and managing of risk. In addition, risk management policies will clearly
defined responsibilities for risk management throughout the enterprise to Board
of Directors; The subordinate units; Departments; Risk management department
(if any); the internal audit department – internal control. The implementation
of risk management activities should be tied to
business
strategy, annual budget plan and the business cycle in the
enterprise.
Risk Management Process
Basically,
risk management
processes typically include basic steps such as: confirmation
of the business objectives, identify risks, description and classification of
risk, assessment and risk ratings, response planning development, reporting an
update on implementation, monitoring the process of implementation, review and
improvement of risk management processes. Details of some of the main steps in
the risk management process are as follows:
Confirmation of business objectives
Risk management activities are organized and implemented towards
ensuring the successful implementation of the enterprise objectives. Therefore,
at the begining the risk management process, the first task that business
leaders need to do is confirming the operational
goals of the
business. This will be the base to ensure that risk management
activities are held in the right direction.
Identify Risks
There are many methods to identify risk. Each method has different
advantages and disadvantages. However, the following methods are considered
using to determine the risk:
- Organize risk assessment
workshop;
- Organize “Brain Attack”
meeting;
- Questionnaire;
- Audit and inspection;
- Based on industry norms;
- Situation analysis
In fact, the method of determining risk that are used most in
organizations is organizing risk assessment workshop. Attending the workshop
are the Board of Directors and leaders of all departments. Members at the
workshop will exchange information to give a list of business risks. In many
cases, the result of the risk identification process is a long list of
potential risks. However, this should not be too worried, the implementation of
the next steps of the risk management process will help identify clearly the
risks that are really the great risk to enterprises.
Description and classification of risk
After identifying potential risks, the next step is to describe
briefly but specifically about the origin, cause, consequence and impact of
each risks to the enterprise.
Next, we will implement the risk classification. There are many
different types of potential risks for enterprises. They can originate inside
or outside the enterprise. Based on the nature of the risk, they are many way
to classify risk. However, the most common way is to classify risk into 4
groups as follows:
- Financial risk: interest
rate, exchange rate, credit source, cash flow and ability to pay…;
- Strategic risk:
competition, customer changes, industry changes, risks for research and
development activities, intellectual property…;
- Operational risk: the
leaders, corporate culture, violation of management rules, financial
control, information systems…;
- Dangerous risk: environmental
risks, supplier, natural disaster, risks for assets, contracts,
products and services…
The classification of risks as above will help enterprises to manage
risk in a systematic way.
Assessment and risk rating
Enterprise resources are limited while the number of the risks is
great. So, the next step is to organize, evaluate and ranking risks according
to priority level of response. Enterprises will analyze, evaluate each risk
according to two criteria: the possibility of risk and the extent of the risks
affecting the business if happened. The risk that the businesses need to
prioritize response and prevent is the risk with high likelihood and degree of
influence.
Develop response plans
Develop response plans is an important stage in the process of
risk management. At this stage, enterprise should given the preventive measures
and specific control should be taken to prevent and minimize damage if the risk
occurs. There are 3 contents that must be determined for each specific risk
when developing response plans:
1.
Measures that should be
implemented to prevent risks;
2.
The completion deadline
for those measures;
3.
The person that
responsible for managing that risk.
Monitoring the implementation of measures
In the process of implementation of response measures, businesses
need to build a system of reporting regularly to ensure strict control of the
implementation process. Enterprises also need to ensure that all shortcomings
in the implementation of risk control measures must be timely reporting to
leaders.
At the same time, business leaders must also build a culture of
risk management to every staffs in the enterprise. It is high time that the
corporate governance should seriously view the role of risk management
activities, consider setting up and maintaining a
risk management
system in business. Practical experience shows that, once the risks
are forecasted, enterprises can fully develop and deploy effective response
plans for sustainable development.
