Risk management is a key component of the P3 syllabus, comprising a significant part of section B, "Risk and internal con- trol" (25 per cent study weighting), and appearing in sections D, "Financial risk", and E, "Information systems risk". It's crucial for organisations to identify and manage the risks they run. Ultimately, if a business can't identify the risks it faces, it has little chance of establishing the controls required for managing them.
Although P3 candidates need to be able to iden- tify and evaluate risks in an exam question, they often find this hard. Common problems include:
Failing to identify risks.
Choosing risks that aren't specific to the scenario.
Giving poor descriptions of risks.
Providing a weak evaluation – or no evaluation.
Before reviewing the basics of risk identification – the first stage in CIMA's risk management cycle (see chart, opposite page) – let's remind ourselves of the meaning of risk. When we're considering this concept, words that often come to mind include "cost", "loss" and "surprise". It's a common ten- dency to focus on the negative aspects – ie, looking for things that might go wrong. This is referred to as downside risk. It is important to remember that risk may be positive (known as upside risk), where the outcome is better than expected. But the idea of risk as something that's uncertain is crucial. A risk is something that might happen. To illustrate this, let's look at the scenario in the panel, right.
Now consider the following two statements about the bank's call centre:
"There's a risk that the bank will incur training costs next year to ensure that new starters have suf- ficient skills to do their jobs."
"There's a risk that the bank may incur extra train- ing costs in the coming year if its staff turnover exceeds that of the past year."
The latter statement correctly identifies a risk facing the business, since it refers to an uncertainty – something that might happen. The first one merely confirms the fact that new recruits will need train- ing, so costs will be incurred. This underlines an important thing to bear in mind when identifying risks: it's crucial to look for uncertain events that "may", "might" or "could" happen, instead of simply citing adverse future events. If you can use any of these three words in your description, this will show that you have grasped the concept. (These uncertain events could, of course, be positive things, such as a reduction in training costs if staff turnover falls).
At this stage it's worth considering the generic lists of risks you'll have encountered in your P3 stud- ies – eg, reputational, environmental and political. These terms are handy for grouping similar risks into categories and they may be used by the exam- iner when asking you to look for particular types of risk. But they don't always help you to describe the risks you find. Don't waste effort trying to fit every risk into these categories. A statement that "there is a reputational risk" doesn't say much about your application of knowledge to the scenario, whereas stating that "there's a risk that the busi- ness's reputation could suffer as a consequence of poor customer service provided by staff" gives a far more useful description and will earn more marks.
Once you have correctly identified the risks in the scenario, it's important to describe them in enough detail to earn all the marks available for this. A simple format for describing risks is: "There is a risk that [something] may [do something] that would lead to [some type of effect on the company]."
In the case of the call centre, the risk could be described as follows: "There is a risk that training costs may increase in the coming year if staff turn- over rises, resulting in an adverse impact on the bank's profit."
This statement has clarified what the risk is and has started to give some idea of the effect it may have. But, given that P3 is a strategic-level paper, it's unlikely that you'll be asked merely to identify risks. "Identify" is only a level-two verb. The more common requirement in P3 is to "evaluate" – a level-five verb. here, you'll need to discuss points such as whether the risk is significant; whether it is the kind of thing that the business should be looking out for all the time or whether it's a rare occurrence; and what may cause the risk to arise. Don't go on and recommend what should be done about the risk. If that's a require- ment, it will be contained in a separate question.
If there is a specific requirement to discuss the impact and likelihood of the risks (the "Understand and assess scale of risk" step in CIMA's risk manage- ment cycle), it will be in a question that uses those terms or refers to the creation of a "risk map" or "impact-likelihood matrix". This can be seen in the wording of question 1(a)(i) in the May 2011 paper.
Going back to our scenario, let's attempt to evalu- ate two risks facing the bank:
1: There is a risk that training costs may rise if staff turnover increases. But, given the high level of unem- ployment starting to affect the region, it may be that staff choose to remain with the call centre rather than risk being out of work. So, although the risk may affect the bottom line, it is likely to be a lower risk this year than may have been the case before.
2: At any level of staff turnover it is possible that new recruits may not work to the required standards. There is therefore a risk that customer satisfaction may decline and even that the bank may lose busi- ness. A significant investment in training goes some way towards mitigating this, but the risk remains. It has become relatively easy for customers to switch banks, so service is still a crucial factor.
A final consideration when tackling questions on the evaluation of risks is to ensure that you answer exactly what is being asked of you. here are a few examples of requirements from recent questions:
"Evaluate the risks to the quality of service offered to C's clients arising from the competitive nature of the firm's culture." Question 2(a), May 2011.
"Evaluate the risks to the retailer of accepting for- eign currency payments at its shops and cafés." Question 1(c), March 2011.
"Evaluate the risks associated with the use of EDI for managing W's ordering and accounting proc- esses." Question 2(b), November 2010.
All of these questions had an important similar- ity: none asked candidates to evaluate all of the risks they could find in the scenario. Each was looking for risks arising from a specific event or situation: oper- ating a culture of competitiveness, accepting foreign currency payments or using EDI. The first require- ment was even more specific, looking at risks related to a given factor: service quality.
No marks will be available for citing risks that don't directly address the question. Writing a generic list of all types of risks, ignoring the require- ments, will also fail to impress the markers.
So, returning again to the bank call centre, let's consider the following requirement: "Evaluate the risks to customer service facing the bank arising from the high staff turnover at the call centre."
The second of our previously evaluated risks – the possibility of losing business as a consequence of a decline in service quality – would fit perfectly as an answer to this requirement, since it focuses on the customer service aspect of the business.
So, to summarise this article from the perspective of a P3 candidate, what is the risk with risk? Answer- ing this question using the language we have been discussing, it is the risk that you may not identify the correct risks as required by the question; that you may not describe the risks clearly enough; or that your evaluation may not be detailed or specific enough. These risks may lead to a loss of marks and, potentially, cause problems for the recommenda- tion of any controls designed to mitigate these risks. But, given that all candidates will practise plenty of past questions, review the examiner's answers and read articles such as this, the risks may be consid- ered unlikely to arise. |
