8/25/2014

techbus.safaribooksonline.com/print?xmlid=9780749470531%2Fzch2_7_xhtml

Username: Sidh Singh Book: Practical Enterprise Risk Management. No part of any chapter or book may be reproduced or transmitted in any
f orm by any means without the prior written permission f or reprints and excerpts f rom the publisher of the book or chapter. Redistribution or other
use that v iolates the f air use priv ilege under U.S. copy right laws (see 17 USC107) or that otherwise v iolates these Terms of Serv ice is strictly
prohibited. Violators will be prosecuted to the f ull extent of U.S. Federal and Massachusetts laws.

Identifying risk: types of risk, risk lists and taxonomies

A list of prompts is used in risk identification to ensure that there is a holistic review of the threats and opportunities that might threaten or enhance a particular strategic goal or
value driver. Without a list there may be too much emphasis on some threats and opportunities and gaps where some areas are not considered. For example, a finance-driven
group who are conducting a risk assessment might mainly concentrate on financial aspects, health practitioners might tend to concentrate on clinical threats, and project
managers on project threats and opportunities.
The advantage of a risk taxonomy or risk classification system as opposed to a straightforward risk list is that connections between interrelated risks can be made. This
enables a more valid prioritization of the most important threats and opportunities and recognition of the themes that are relevant to the organization.
In December 2012, the Economist Intelligence Unit conducted a global survey, sponsored by KPMG International, of more than 1,000 senior executives from the corporate
suite or board (C-suite).4 One of the questions asked was: Which of the following issues pose the greatest threat to your industry? The results are shown in Table 2.3, with the
percentages showing the most important risks (more than one risk could be selected in this survey). The second largest item in the list was reputation. However, reputation risk
doesnt appear in many risk lists, because reputation risk isnt really a risk at all: its a consequence or impact of many of the other threats and opportunities.
TABLE 2.3

Principal risks; KPMG survey

%
Regulatory pressure/changes in regulatory environment

49

Reputational risks

41

Credit/liquidity risks

34

Geopolitical risks (EG Eurozone crisis)

32

Supply chain disruption

28

Information security/fraud

17

Disruption of technology

17

Data governance and quality

13

Legal

12

IT infrastructure

11

Social media

Natural disasters

Climate change

Any event that has a positive or negative impact on the organization can change the reputation of the business for better or for worse. We can have a specific business
strategy to deal with reputational impacts, but that will end up as our risk strategy, as we will soon work out that many if not all of the strategic, operational or project risks to the
business could have a reputational impact (amongst other impacts).
The reputational effect of risk events has a habit of taking on a life of its own after the occurrence. What started with a fatal explosion subsequently resulted in years of
continuing uncertainty for BP, loss of jobs and major costs as people sought compensation for their apparent (and sometimes non-existent) losses.

CASE EXAMPLE

(Quote from The Washington Times, 8 August 2013, regarding the Deepwater Horizon oil spill.5 )
The Deepwater Horizon oil spill was an oil spill that began in April 2010 in the Gulf of Mexico on the BP-operated Macondo Prospect. It is considered to be the largest
accidental marine oil spill in the history of the petroleum industry. Following the explosion and sinking of the Deepwater Horizon oil rig, which claimed 11 lives, a sea-floor oil
gusher flowed for 87 days, until it was capped on 15 July 2010. The total discharge is estimated at 210 million US gal or 780,000 m3 .
On Wednesday 7 August 2013, a federal judge ruled that BP must pay $130 million to a court administrator to disburse among those who claimed they were injured from the
2010 Gulf of Mexico oil spill.
BP had fought the fees, calling them excessive costs, one attorney for the company said, Reuters reported. But US Magistrate Judge Sally Shushan in New Orleans found
differently. She called it unreasonable that BP would halt its payments to claimants payments that have already surpassed $560 million since June 2012, Reuters said.
BP didnt comment on the judges ruling. But the companys main argument is that a fee schedule worked out in 2012 during settlement talks with Gulf-area businesses and
residents is unfair. The total amount the company could end up paying, when alls said and done, is $1.5 billion, a BP finance director predicted, Reuters reported.
On top of that, BP said, much of the fee money has been paid for fraudulent claims. In all, BP faces about $42.4 billion worth of charges that are related to the April 20 2010,
drilling rig explosion that killed 11.

Many organizations order the risks to an organization in a form of risk classification system (see Figure 2.6):
Strategic risks include risks from: reputational damage (eg, trademark/brand erosion, fraud, unfavourable publicity) competition, customer wants, demographic and
social/cultural trends, technological innovation, capital availability, and regulatory and political trends.
Financial risks include risks from: price (eg asset value, interest rate, foreign exchange, commodity), liquidity (eg cash flow, call risk, opportunity cost), credit (eg default,
downgrade), inflation/purchasing power, and hedging/basis risk.
Operational risks include risks from: business operations (eg, human resources, product development, capacity, efficiency, product/service failure, channel management,
supply chain management, business cyclicality), empowerment (eg, leadership, change readiness), information technology (eg, relevance, availability), and
information/business reporting (eg, budgeting and planning, accounting information, pension fund, investment evaluation, taxation).
Hazard risks include risks from: fire and other property damage, windstorm and other natural perils, theft and other crime, personal injury, business interruption, disease

http://techbus.safaribooksonline.com/print?xmlid=9780749470531%2Fzch2_7_xhtml

1/2

8/25/2014

techbus.safaribooksonline.com/print?xmlid=9780749470531%2Fzch2_7_xhtml
and disability (including work-related injuries and diseases), and liability claims.

FIGURE2.6

Example of a risk classification system

The main disadvantage of using a risk classification system is the implication that each of the areas of risk are equal, whereas in reality they are not and vary enormously from
one industry to another.

http://techbus.safaribooksonline.com/print?xmlid=9780749470531%2Fzch2_7_xhtml

2/2