Fundamentals of Risk Management

Risk response
182
In these circumstances, appropriate responses would be elimination of the risk by 
stopping the process or activity, substituting an alternative activity or outsourcing 
the activity that is associated with the risk.
An organization may wish to terminate a risk, but it could be the case that the 
activity that gives rise to it is fundamental to the ongoing operation of the organization. 
In such circumstances, the organization may not be able to terminate or eliminate 
the risk entirely and thus will need to implement alternative control measures.
This is a particular issue for public services. There may be certain risks that
have high likelihood and high impact, but the organization is unable to terminate
the activities giving rise to them. This may be because the activity is a statutory
requirement placed on a government agency or public authority. The public service 
imperative may restrict the ability to cease the activity, so the organization will need 
to introduce control measures, to the greatest extent that is cost-effective.
It is likely that such control measures will be a combination of risk treatment and 
risk transfer. As these control measures are applied, the level of risk will move to a 
level where the organization will be able to tolerate the risk. Because of the variable 
nature of risks, it may not be possible to get all risks to a level that is within the risk 
appetite of the organization. The organization may find that it has to tolerate risks 
beyond its empirical risk appetite in order to continue to undertake a certain activity.
strategic risk response
The overall approach to the management of control and opportunity risks is similar 
to the approach adopted for the management of hazard risks. However, there are 
sufficient differences in the range of options available for these to be presented
separately. It is worth remembering that projects normally reflect and implement the 
tactics that are being employed to implement strategy.
Figure 16.1 illustrates the 4Ts of hazard risk management and the type of controls 
that are most likely to be associated with each type of hazard risk response.
The types of controls are considered below. This chapter has been concerned almost 
exclusively with responding to hazard risks. The 4Ts represent the options for
mitigating hazard risks. 
Figure 15.2 suggests that there are a range of responses available for the management 
of opportunity risks. Developing and implementing effective and efficient strategy 
will require the evaluation of the level of risk associated with each available strategy 
and the level of reward that the strategy will deliver.
The 4Es of opportunity management are set out as exist, explore, exploit and exit. 
There is a close relationship between the 4Es and the status of the organization,
as illustrated in Figure 15.2. A start-up operation will face a higher level of risk and 
low potential rewards.
Entrepreneurial opportunities will be explored at this time. As the organization 
grows, potential rewards will increase while the level of risk will remain high. The 
organization will seek to achieve growth, but may feel that growth is too slow or the 
level of risk remains too high, and if so it will exit from those operations.

---