Fundamentals of Risk Management

TAbLE 
14.2
continued
Score
Description of
the level of risk
Score
Description of
the level of risk
0
No risk
3
Medium risk
1
Little risk
4
High risk
2
Some risk
5
Extreme risk
Calculating the riskiness index of an organization requires identification of the
hazard risks actually being taken by that organization. In other words, evaluating 
the riskiness index of an organization helps to identify the actual risk exposure of that 
organization. Having identified the actual level of risk embedded within an organ-
ization, the board of that organization can then ask whether the portfolio of risks is 

---

Defining the upside of risk 
167
within the risk appetite and/or the risk capacity of the organization and compatible 
with the risk attitude of the board.
The 2016 version of the UK Corporate Governance Code contains the following 
requirement for companies listed on the London Stock Exchange:
The board is responsible for determining the nature and extent of the principal risks it is 
willing to take in achieving its strategic objectives.
Organizations should be careful to ensure that, having identified the risks that they 
are taking by a mechanism similar to calculating the riskiness index, the board does 
not then simply decide that the risks it is currently taking must be the same as the 
risks it is willing to take.
Upside in strategy
Organizations will have a mission statement, together with a set of corporate objec-
tives and an understanding of the expectations of the different stakeholders in the 
organization. The board of the organization then needs to develop an effective and 
efficient strategy that will deliver exactly what is expected in terms of the mission, 
objectives and expectations. In order to make correct strategic decisions, the board 
of the organization will need access to risk information. A risk assessment of the 
proposed strategy, together with a risk assessment of any viable alternative strategies, 
should be undertaken. The availability of this risk assessment information will ensure 
that the strategic decisions are more likely to be correct.
For opportunity risks, there is probably even less data available on which to predict 
risk likelihood. An organization may see an opportunity to acquire a new client or 
develop and market a new product. Accurate risk assessment of the likelihood of 
positive and negative events will be necessary in order to determine whether the new 
venture should go ahead. When a new product is launched, the requirement may 
well be to increase the likelihood of a positive event occurring. If a new product is 
being launched, advertising and press coverage will need to be maximized up to the 
point that this remains cost-effective. Actions should therefore be taken to increase
the level of media interest in the launch.
Strategic core processes bring the disciplines of strategic planning and risk manage-
ment together. Strategic planning is a systematic process for obtaining a consensus at 
board level on the small number of issues that could have a massive effect on the 
long-term performance of the organization. Strategic issues are vitally important, 
and failure to implement strategy or the selection of an inappropriate strategy can be 
amongst the most devastating risks to hit an organization. Implementation of strategy 
is usually achieved by developing tactics that are implemented by way of projects 
and then ultimately delivered by operational core processes. The operational core 
processes in place at a specific time represent the business model of the organization, 
as is discussed in more detail in Chapter 20.
Risk management activities are designed to ensure the best possible outcome and 
reduce uncertainty. Therefore, the upside of risk in strategy is that risk management 
efforts help with the design of an effective and efficient strategy. The implementation 

---