Fundamentals of Risk Management

Introduction to risk management 
40
Controllable risk factors for heart disease and stroke are those that can be changed through 
diet, physical activity and no tobacco use. These risk factors are in contrast to those that are 
uncontrolled, such as age, gender, race or genetic traits. Having one or more uncontrollable 
risk factors does not mean a person will have a heart attack or stroke; however, with proper 
attention to those risk factors that are controllable, one may reduce the impact of those risk 
factors that cannot be controlled or changed.
Controllable risk factors for heart disease or stroke include high blood pressure, high blood 
cholesterol, type-2 diabetes and obesity. Healthy lifestyle habits, such as developing good eating 
habits, increasing physical activity and abstaining from tobacco use, are effective steps in both 
preventing and improving the controllable risk factors.
Heart disease risk factors
Manage uncertainty risks
When undertaking projects and implementing change, an organization has to accept 
a level of uncertainty. Uncertainty or control risks are an inevitable part of under-
taking a project. A contingency fund to allow for the unexpected will need to be part 
of a project budget, as well as contingent time built into project schedules. When 
looking to develop appropriate responses to control risks, the organization must 
make the necessary resources available to identify the controls, implement the controls 
and respond to the consequences of any control risk materializing.
The nature of control risks and the appropriate responses depend on the level of 
uncertainty and the nature of the risk. Uncertainty represents a deviation from the 
required or expected outcome. When an organization is undertaking a project, such 
as a process enhancement, the project has to be delivered on time, within budget and 
to specification. Also, the enhancement has to deliver the benefits that were required. 
Deviation from the anticipated benefits of a project represents uncertainties that 
can only be accepted within a certain range.
Control management is the basis of the approach to risk management adopted
by internal auditors and accountants. The risk management requirements of the UK 
corporate governance code (as at September 2016) concentrate on internal control 
with little reference to risk assessment. Control management is concerned with redu-
cing the uncertainty associated with significant risks and reducing the variability of 
outcomes.
There are dangers if the organization becomes too concerned with control manage-
ment. The organization should not become obsessed with control risks, because it is 
sometimes suggested that over-focus on internal control and control management 
suppresses the entrepreneurial effort.

---