Fundamentals of Risk Management

www.hm-treasury.gov.uk
International Standard ISO/IEC 31010:2009 Risk Management: Risk Assessment 
Techniques, 
www.iso.org
Management Consultancies Association (2007) The Upside of Risk, 
www.mca.org.uk
Taylor, E (2014) Practical Enterprise Risk Management, 
www.koganpage.com
WA Government (2011) Risk Management Guidelines, 
www.wa.gov.au
115

---

Risk assessment
116
PART THREE cAsE sTUDIEs
AA: Risk governance
The group-wide risk assessment requires business units to formally review business risks each 
quarter. This approach to identification, analysis and assessment of risks ensures responsibility so 
that they are managed, controlled and monitored. A broad spectrum of risks is considered through 
this process including those relating to strategy, operational performance, finance, product 
engineering and technology, business reputation, human resources, health and safety and the 
environment. The causes and the consequences of each risk are considered and, where appropriate, 
linked to strategic and operational objectives.
Management controls designed to monitor and mitigate risks are documented. Risk owners are 
assigned to each risk. The risk response is based upon the assessment of potential risk exposure and 
the level of accepted tolerance. The response reflects whether we accept the risk on the basis of its 
assessed level of exposure and mitigating controls currently in place, where possible, or reduce the 
risk through additional mitigation to bring it in line with required levels of tolerance.
The duties of the risk committee include advising the board on the group’s overall risk appetite, 
tolerance and strategy. The risk committee and the board have reviewed and approved a revised risk 
appetite since we became a listed public company.
As with any business, we face risks and uncertainties on a daily basis. It is the effective 
management of these that places us in a better position to be able to achieve our strategic objectives 
and to embrace opportunities as they arise. The board has considered carefully the nature and extent 
of the significant risks it is willing to take in achieving the group’s strategic objectives and delivering 
a satisfactory return for shareholders.
Edited extract from AA plc
Annual Report and Accounts 2015