Risk man­age­ment: How to make sound decisions

“Risk man­age­ment” describes all the measures for iden­ti­fy­ing and in­flu­enc­ing the op­por­tu­ni­ties and threats that arise in the course of business activity. These op­por­tu­ni­ties and risks can have a positive or negative impact on the success of the business.

It is not the task of risk man­age­ment to eliminate all threats – because that is prac­ti­cal­ly im­pos­si­ble. Rather, the goal is to optimize the re­la­tion­ship between op­por­tu­ni­ties and risks. In other words, suc­cess­ful risk man­age­ment con­tributes to decision-making and planning security, minimizes the risk of in­sol­ven­cy, and sta­bi­lizes the earnings situation.

Risk man­age­ment not only makes economic sense for companies, it’s also a legally binding building block in corporate man­age­ment. However, risk man­age­ment is not regulated in any single law or code – rather, there are a number of different laws in the US that impinge on risk man­age­ment.

After several corporate crises in the early 1990s, the US federal gov­ern­ment took a major reform step in 2002 and passed the Sarbanes-Oxley Act. It is a federal law that sets new or expanded re­quire­ments for all US public company boards, man­age­ment and public ac­count­ing firms. A number of pro­vi­sions of the Act also apply to privately held companies, such as the willful de­struc­tion of evidence to impede a federal in­ves­ti­ga­tion.

The sections of the bill cover re­spon­si­bil­i­ties of a public cor­po­ra­tion’s board of directors, add criminal penalties for certain mis­con­duct, and require the Se­cu­ri­ties and Exchange Com­mis­sion to create reg­u­la­tions to define how public cor­po­ra­tions should comply with the law. In addition, there is a legal stip­u­la­tion that risks must also be ad­e­quate­ly taken into account in any business decision (this is called the Business Judgment Rule: It is rooted in the principle that the “directors of a cor­po­ra­tion ... are clothed with [the] pre­sump­tion, which the law accords to them, of being [motivated] in their conduct by a bona fide regard for the interests of the cor­po­ra­tion whose affairs the stock­hold­ers have committed to their charge.”

In addition, there are still some national standards that may not be legally binding but are in effect required in order for busi­ness­es to meet investors’ ex­pec­ta­tions: These include, for example, the Auditing Standards for Private Companies (issued by the American Institute of Certified Public Ac­coun­tants) and the Generally Accepted Ac­count­ing Prin­ci­ples.

The most important in­ter­na­tion­al standards include the risk man­age­ment standard ISO 31000:2009, the quality man­age­ment standard ISO 9001:2015, and the COSO En­ter­prise Risk Man­age­ment Framework (COSO ERM 2017). The framework, also known as the COSO cube, cat­e­go­rizes risk man­age­ment according to com­po­nents, target cat­e­gories, and or­ga­ni­za­tion­al units.

The guide­lines set out in these standards are intended to help companies implement their own risk man­age­ment and develop it further. Both the ISO and the COSO standards are regularly reviewed and, if necessary, adapted to reflect current de­vel­op­ments in the corporate world.

Fre­quent­ly, risk man­age­ment is linked to com­pli­ance and corporate gov­er­nance in companies, because all three dis­ci­plines are closely related to one another. They all con­tribute to proper and efficient corporate gov­er­nance.

Corporate risk man­age­ment can be divided into strategic and op­er­a­tional risk man­age­ment. The strategic aspect involves defining risk man­age­ment ob­jec­tives, for­mu­lat­ing an over­ar­ch­ing strategy, and defining op­er­a­tional processes. Im­ple­ment­ing these processes is the task of op­er­a­tional risk man­age­ment.

The first step is risk de­ter­mi­na­tion, which involves sorting, iden­ti­fy­ing, and de­scrib­ing all existing risks qual­i­ta­tive­ly, in­di­vid­u­al­ly, and by risk area. This can be done on the company’s level as well as at the project level. Decision-makers can use different methods to structure the iden­ti­fi­ca­tion process and ensure that all threats and sources of harm are iden­ti­fied:

• Expert and employee surveys
• Eval­u­a­tion of existing data and documents
• Internal risk workshops
• Factory and site visits

At the end of this phase, a complete risk catalog (also: risk inventory) should have been created.

In the next step, each in­di­vid­ual risk is quan­ti­ta­tive­ly assessed with regard to its prob­a­bil­i­ty of oc­cur­rence and its potential impact. In the as­sess­ment, not only one risk must be con­sid­ered in isolation, but also the con­se­quences of several risks in­ter­act­ing or ac­cu­mu­lat­ing over time. This aspect is also referred to as risk ag­gre­ga­tion.

Prob­a­bil­i­ty dis­tri­b­u­tions or frequency dis­tri­b­u­tions are used in quan­tifi­ca­tion. The concrete measure used to assess a risk is called the “value at risk”.

Steps 1 and 2 are also referred to col­lec­tive­ly as risk analysis. This analysis is con­sid­ered to be the most difficult step in the risk man­age­ment process, as not only current but also future risks need to be iden­ti­fied and assessed. Once the results of the risk analysis have been evaluated, the risks that have a par­tic­u­lar­ly high prob­a­bil­i­ty of occurring have priority and should be dealt with first.

Risk man­age­ment involves examining the methods applied with regard to their ef­fi­cien­cy, ap­pro­pri­ate­ness, and ef­fec­tive­ness. Con­trol­ling can take place in two ways that ideally com­ple­ment one another: as con­tin­u­ous mon­i­tor­ing in real time and as periodic in-depth risk as­sess­ment. The results are promptly forwarded to those re­spon­si­ble.

Risk man­age­ment is not the re­spon­si­bil­i­ty of one in­di­vid­ual, but concerns every employee in the company. Although the strategy and fun­da­men­tal ori­en­ta­tion of risk man­age­ment are de­ter­mined by man­age­ment, other employees are involved in the op­er­a­tional business.

The model of the three lines of defense is often used for al­lo­cat­ing re­spon­si­bil­i­ties in risk man­age­ment:

• First line: Managers and employees react to op­er­a­tional risks in ac­cor­dance with the defined strate­gies – supported by an internal system of controls.
• Second line: Employees who are directly involved in risk man­age­ment tasks support and monitor the first line, e.g. by spec­i­fy­ing methods or coaching.
• Third line: Risk man­age­ment is monitored by an in­de­pen­dent body.

Iden­ti­fy­ing and managing risks is an integral part of our corporate culture. Therefore, risk man­age­ment is not confined to the top floor. However, it affects every single employee in his or her daily work.

Anyone who does not take into account the possible negative effects of their decisions in advance ul­ti­mate­ly endangers the economic stability of a company. With its methods, risk man­age­ment offers the necessary tools to clearly identify risks instead of relying on a vague gut feeling. This makes it possible for companies to take cal­cu­lat­ed risks that are necessary for growth and success.