Risk management is a discipline that permits customers and organizations to cope with uncertainty by taking steps to protect its vital possessions and resources (2001: 121). Risk management as so described involves a couple of things: (a) insuring that the potential risks to which people and businesses expose themselves will be the risks they are prepared to take; and (b) such hazards are minimized.
Culp (2001) argues that risk management is definitely not exactly like risk reduction. This is for two reasons. First, one cannot eliminate all dangers. Second, some dangers are higher than others. It really is insufficient-indeed, pointless-for a person or organization to produce a "laundry list" of most conceivable hazards and treat them as being the same. You have to prioritize hazards, and do something consequently. This brings one to the idea of key risk management decisions.
What are the key risk management decisions
The literature (e. g. , Culp, 2001) shows that, prior to handling risk, organizations must make four key decisions. Table 1 lists them.
Table. Key risk management decisions.
Number
Decision
Description
1
Identify risk
Identify those potential issues that could conceivably occur
2
Prioritize hazards in conditions of probability
Distinguish between those dangers that are usually more possible than others.
3
Prioritize dangers in terms of the destruction they may cause
Determine how much damage the danger, if it is noticed, will occur
4
Determine what's practicable
Determine which of the important (i. e. , probable and expensive if became aware) risks can, used, be reduced.
These four decisions contain subtleties. There is a trade-off between probability and destruction, for example. A risk that is highly probable of happening but which causes little damage may become more important than a risk that is improbable of occurring but which may cause much destruction.
There is also a subtlety in deciding what's practicable. First, those hazards that are impracticable to resolve may be so, not only because there could be nothing people can do to reduce them, but also since it might be very costly to reduce them (i. e. , the cost of risk-avoidance might become more expensive than the potential harm).
The dependence on a cost-benefit research pertains to the precautionary process. This is the principle that expresses that you need to make an effort to remove all dangers. However, many claim that the precautionary theory is absurd, and counter-productive (see, e. g. , Wildavsky, 1995). Such critics claim that the huge costs of some risk-management exercises are definitely more harmful-in that they entail money that might be better spent elsewhere-than the risks they are thought to contain.
Risks to organizations
Risks to organizations are of four types: financial, proper, operational, and threat. Risks come from two resources: exterior and internal. Physique 1 shows the Institute of Risk Management's (IRM) (2002) types of external hazards.
Figure. Examples of external hazards. Source: designed from IRM (2002).
There may be much that organizations can do to manage many of these risks. Hedging operations, for example, can help diminish financial hazards from currency violations, for example. Insurance and modern architecture can help diminish hazards such as earthquakes.
Figure 2 shows IRM (20002) examples of internal risks.
Figure. Types of internal dangers. Source: adapted from IRM (2002).
There are no interior hazards-individuals do not cause earthquakes, but there are interior hazards of the other three types. Many organizations must, for example, commit seriously in research and development-itself a high-risk activity, because it is expensive and could produce no results-and, having done so, protect their intellectual property rights. Whelan (1993) reports, for example, that pharmaceutical companies invest intensely on research-which may take years-and that the quality of the research is often better than that sponsored by authorities organizations.
Costs
The costs of hazards are of two kinds: immediate and indirect (Culp, 2002).
Direct costs
The direct costs of hazards, recognized or not, are those that can simply be got into into a organization's balance sheet. When hazards are became aware, for example, the expenses include harm to property-the organization's or that of an wounded third party-compensation to people harmed by the organization's/products, legal fees to lawyers in struggling litigations, punitive problems granted by courts of rules, etc. When risks aren't realized, immediate costs continue to be. Organizations tolerate the direct costs of paying insurance, and, in the case of larger organizations, of utilizing attorneys and risk avoidance experts, health insurance and safety experts, and so on. In utilizing such experts, the organizations take the risk that the huge amounts they pay in avoiding risk do not cost more than any destruction triggered by the putative risks. In addition they take the risk that such experts will appropriately identify and mitigate putative risks.
Indirect costs
Indirect costs only enter into play when hazards are realized. In such instances, they may be vastly greater than immediate costs. Thus, for example, when Gerald Ratner stated in public areas that the reason why he could sell jewelry at low prices was that the jewelry was "crap", his business empire-comprising a nationwide chain of rings shops-collapsed. The expense of this gaffe was around 500 million (The Sunday Times, 2007).
Managing risks
Organizations can do much to control risks, and far is common sense. Nursing homes, for example, can ensure standard methods for the supervision of drugs; finance institutions can ensure cash is stored in secure vaults; establishments for the criminally insane can ensure that knives are placed away from inmates; governments can ensure that hypersensitive telephone discussions are encrypted ("scrambled"); and so on. Such obvious measures are standard, and doubtless ensure that many dangers are rarely, if ever, recognized. Moreover, to a large amount, organizations can reduce risk of serves of God by firmly taking out insurance.
A key factor in this is to truly have a risk management strategy. See Number 3.
Modification
Formal audit
Figure. Risk management circuit. Source: adapted from IRM (2002)
The shape shows the risk management cycle. The main feature of the amount is its framework. Everything in the number flows round the organizations strategic targets. Thus risk management should be part of an organisation's proper planning. In the organisation's strategy the subsidiary top features of the figure flow down-from risk assessment to monitoring. However, this does not imply risk management by management diktat. The physique implies that all periods of the cycle receive constant type from formal audits and all periods are constantly changed. Thus the chance management cycle includes all an organisation's employees, on a regular basis. This implies that risk management evolves, and it is holistic.
This is made plainer by the IRM's (2002) advice on management and staff responsibilities in regards to risk. See Table 2.
Table. Responsibilities of organization staff in regards to risk. Source: designed from IRM (2002). Quotation is direct (p. 9).
Directors
Business units
Individuals
know about the most significant dangers facing the organization
be alert to risks which fall season into their area of responsibility, the possible influences these may have on other areas and the consequences the areas may have on them
understand their accountability for individual risks
know the possible effects on shareholder value of deviations to expected performance ranges
have performance indicators which permit them to monitor the main element business and financial activities, improvement towards objectives and identify innovations which require intervention (e. g. forecasts and finances)
understand how to enable constant improvement of risk management response
ensure appropriate levels of awareness throughout the organization
have systems which speak variances in costs and forecasts at appropriate consistency to allow action to be taken
understand that risk management and risk awareness are a key part of the organization's culture
know the way the organization will control a crisis
report systematically and rapidly to senior management any identified new hazards or failures of existing control measures
report systematically and rapidly to senior management any recognized new risks or failures of existing control measures
know the importance of stakeholder self confidence in the organization
know how to control marketing communications with the investment community where applicable
be promised that the chance management process is working effectively
publish a definite risk management insurance plan covering risk management philosophy and responsibilities
The burden of responsibility on the directors demonstrates the strategic need for managing risks. The responsibilities of business units and individual employees indicate the critical characteristics of risk identification and the necessity for all those employees to understand it.
When one speaks of dangers, one usually considers of threats. However, it is clear from Figure 3 that risk research also involves discovering opportunities. These fluctuate. A car supplier, for case, that notices that its automobiles are more dangerous than those of its competitors could see this as an possibility to improve its vehicles and then advertise them because of their basic safety features.
Risk research in the risk management cycle
Table 3 shows the IRM's (2002) tips for risk analysis.
Table. Risk id and research. Source: designed from IRM (2002). Quotation is direct (p. 14).
Risk recognition techniques
Risk evaluation methods and techniques
Brainstorming
Market survey
Questionnaires
Prospecting
Business studies which look at each business process and identify both the inner processes and exterior factors which can impact those processes
Test marketing
Industry benchmarking
Research and Development
Scenario analysis
Business impact analysis
Risk examination workshops
Incident investigation
Auditing and inspection
The table demonstrates there are many techniques for figuring out risk, both formal (e. g. , looking at industry requirements) and informal (e. g. , brainstorming). By implication, a business should use, not just one of the techniques, but several. The concern of brainstorming (people speaking about the unthinkable) is also suggestive. It suggests that employees must be prompted to think and speak readily about potential hazards.
The same will additionally apply to the risk analysis techniques. They may be diverse, and, by implication, automatically so.
Liebeck vs McDonald's
This case included a Ms Liebeck, who, when aged 79, used up herself after spilling a beaker of caffeine she had bought at a McDonald's takeaway. The spilled it while seated in a car beyond your fast-food chain. The burning up was serious. THE BUYER Lawyers of California (1995) record:
A vascular doctor decided that Liebeck suffered full thickness uses up (or third-degree uses up) over 6 percent of her body, including her interior thighs, perineum, buttocks, and genital and groin areas. She was hospitalized for eight days, during which time she underwent skin area grafting. (paragraph 4)
In the initial reading the jury purchased McDonald's to pay almost $3 million to Ms Liebeck, which $2. 7million were in punitive damage. The judge at the hearing called McDonald's behavior "reckless, callous, and willful". The punitive damages were later reduced to $480, 000.
Although the case received much marketing coverage pertaining to frivolous lawsuits, there may be little uncertainty that Ms Liebeck was really injured. Moreover, there can be little doubt that McDonald's was culpable. Five things stand out about this incident (Consumer Lawyers of California, 1995).
McDonald's at the time typically sold caffeine at 180-190F. This was company insurance plan. The temp was significantly higher that coffee dished up in rival takeaways, and much higher than caffeine served at home (about 135F).
McDonald's were aware at that time that any food dished up at over 140F constitutes a burn hazard.
In the period 1982-1992 more than 700 people complained to McDonald's of melts away from its espresso.
McDonald's were aware that most its takeaway customers wanted to consume their caffeine immediately on purchase.
Ms Liebeck at first offered to accept $20, 000, but McDonald's refused.
Notice that there have been two risks to the company prior to the incident. There was a external strategic threat of changes in customer demand in the wake of any customer being harmed by McDonald's foodstuffs. There is an external functional threat of changes in culture in the wake of such incident. The expenses engaged were both immediate (punitive damages, judge costs, etc. ) and indirect (loss of open public goodwill). The latter were plausibly much the higher.
The dangers to the business were foreseeable. The business realized that the heat range of which it dished up its espresso was higher than industry expectations. It knew the temps was hot enough to cause severe uses up. It understood that almost all of its takeaway customers used their coffee at the earliest opportunity, and that many, as acquired Ms Lieback, experienced done so in an automobile. It is commonsense that old people, like Ms Liebeck, may easily spill beverages when relaxing in a car. Worst of most, the company knew that hundreds of individuals were losing themselves with McDonald's espresso. One may surmise that the company's first error had not been to instigate a culture of risk research. Any company worker might have reasoned that the espresso was too hot, but, if any brought this to senior management's attention-as suggested by the IRM's (2002) standards-nobody appears to have acted on it.
The company's next mistake was to continue with the court docket case. It could have had a damage-limitation exercise-paid Ms Liebeck what she required (and even more), announced an immediate cooling of the espresso, donated money to hospices, and so on. This is a lost chance of the company. McDonald's might well have benefitted from the truth, not lost it. Instead, it insisted on taking the circumstance to judge, with the consequent shame.
In conditions of the risk management circuit, McDonald's performed as follows:
Strategic objectives. The business failed to see where its interests lay.
Risk assessment. The business didn't properly examine and assess the chance.
Risk reporting. McDonald's realized of the risks.
Risk treatment and residual risk treatment. The business did nothing.
Monitoring. The company monitored the risk of customers being used up.
Decision. McDonald's made the incorrect decision, double: first by carrying on to provide hot espresso, second by not settling out of court docket.
Most important, the business failed to alter its coverage in the light of repeated incidents of customers burning themselves. This suggests a lack of risk recognition in the business.
Conclusion
Risk management is crucial to organisational performance. It entails monitoring all known risks and investigating potential ones. Most important, it requires all employees in a firm, and therefore implies companies employ a relatively alternative management framework.
The McDonald's circumstance is especially illustrative. It required needless risks, even though it knew of these. It does not appear to acquired risk management, in the form of the risk management cycle, in operation during the incident. The business then compounded its error by failing woefully to see the additional risks involved with fighting the litigation. In this manner, the case illustrates that, although no one can avoid all risks, bad management compounds risks.
