Fundamentals of Risk Management

132

---

Risk classification systems
133
not be treated as being exclusively associated with opportunity management. Risks 
that have the potential to undermine strategy and the successful implementation of 
strategy can destroy more value than risks to operations and tactics. Although long-
term risks can undermine an organization, there is a need to embrace the appropriate 
level of risk embedded in the strategy.
Figure 11.1 illustrates short-term, medium-term and long-term risks in terms of 
the source of these risks. The risks arise from the operations, tactics and strategy 
adopted by the organization. For the sake of completeness, the category of compliance 
risks is also included, since this is an additional category to operations, tactics and 
strategy. The need to respond to risks according to whether they arise from strategy, 
tactics, operations or compliance (STOC) is summarized by embrace, manage, miti-
gate and minimize (EM3) respectively. The purpose of the bow-tie illustration of risk 
management is to demonstrate that sources of risk can lead to events that have 
consequences.
When a hazard event occurs, it will have an impact on the features of the organ-
ization that can cause disruption. For this reason, the event shown in the centre of 
the bow-tie would be listed in terms of the component of the organization that is 
impacted by the event. These components are people, premises, processes and products 
(4Ps), as listed in Table 3.2. It is worth noting that the 4Ps can also be considered to 
be a risk classification system.
The use of a bow-tie to represent risk management has become increasingly
common. Figure 11.1 provides an example of the bow-tie being used to represent
the three components of risk source, event and impact. In this high-level representa-
tion, risk sources are identified as strategic, tactical, operational or compliance. 
Impacts are represented using the FIRM risk scorecard, as described in Table 11.2. 
At the centre of the bow-tie is the event, as described by the component of the