Fundamentals of Risk Management

288

---

24
Risk-aware culture
styles of risk management
We have already seen that there are three (complementary) styles of risk management, 
related to the nature of the risk under consideration. Hazard management, control 
management and opportunity management define and describe the approach and, to 
some extent, the level of sophistication that is applied to risk management by an 
organization at a point in time.
Hazard risks will always have a negative outcome associated with the risk. The 
maximum exposure to the risk that is acceptable to the organization is the hazard 
tolerance. Control risks will have a cost associated with controlling the risks, and 
this cost can be described as the control acceptance. Opportunity risks have a range of 
possible outcomes from highly positive to highly negative. The intended and planned 
outcome is, of course, positive. The organization will be willing to put resources at 
risk in pursuit of opportunity risks, and this is the opportunity investment.
The type of risk under consideration helps determine the style of risk management 
that will be applied. However, some risks may need to be managed using all three 
styles of risk management, at different stages in the lifecycle of the risk. In summary, 
the four styles of risk management can be viewed as follows:
●
●
Compliance management: based on fulfilling legal obligations, such as health 
and safety (1970s).
●
●
Hazard management: ‘total cost of risk’ approach developed by the insurance 
world (1980s).
●
●
Control management: based on the internal control approach of internal 
auditors (1990s).
●
●
Opportunity management: interface between risk management and strategic 
planning (2000s).
The hazard tolerance, control acceptance and opportunity investment are the values 
that the organization is willing to put at risk. These three components added
together are the risk appetite of the organization and represent the total acceptable 
risk exposure of the organization. The total risk exposure is the sum of the risk
exposures for the individual risks and this actual risk exposure may differ from the 
risk appetite of the board and/or the risk capacity of the organization.
The insurance risk manager will normally manage motor vehicle risks as a loss 
minimization or ‘total cost of risk’ issue. The avoidance of internal fraud will normally