Tip:
Highlight text to annotate it
X
This particular lecture is about risk in business
and the title of the lecture is Risky Business.
Really what I want to do here is to give you an impression
of the importance of risk in the everyday operations of a business.
And why as managers, as leaders we need to be aware
of the types of risk a business faces,
you need to be aware of how to measure that risk,
and finally how to manage that risk.
Now, in this introductory lecture I'm just going to spend some time
talking about the types of risk that a business might face.
And in your studies over the next few years
you'll be able to go into this area in a lot more detail.
Whether you study marketing or whether you study HRM
or accounting or finance or international business,
risk is a part of what we do in business
and you have to become very comfortable with the concept of risk.
So what is risk?
If you read the news in any media outlet
or listen to the news on radio or watch it on TV
you hear the word risk used all the time.
People say there's a risk of a major snow storm.
We can also talk about health risks,
we can talk about the risk to the economy.
And what do we mean by risk?
Well, in actual fact risk is a very general term
and what we tend to mean by risk is that it's uncertainty.
Uncertainty and in a lot of people's minds it's not just uncertainty
that captures both upside risk and downside risk,
in a lot of people's minds when we talk about risk
we just talk about downside risk.
The risk or the change or the probability
that something bad will happen to us.
And in business we actually think in those terms.
If we think about the banking sector when we talk about bank risk,
the concern that regulators have and investors have
is the risk or the chance that you will lose money.
Rarely do you talk about the risk or the chance that you'll gain money,
and that's what we generally mean by risk.
It's always on the downside,
and as managers it's up to you to make sure that you know
what those factors are that cause reductions in value,
reductions in cash flow.
And it's up to you to be able to measure those
and it's up to you to be able to manage those.
So when we think about risk we have to think
about risk in three different dimensions.
We need to think about the range of outcomes
that may occur from a particular risk factor.
So if we talk about for example reputational risk.
The risk that something happens that affects your reputation
that affects the value of your company.
This might be a very bad marketing campaign,
it might be your employment practices,
it might be the goods that you're selling.
A very recent case is the case of horse meat in foods.
Those companies that used meats that had horse meat
have a massive reputational risk,
and it's anticipated that a lot of these companies
that were at the source of the horse meat contamination
may actually cease to exist in the next few months
because of the impact that their reputation has been damaged
from the particular horse meat scandal.
So when we think of a risk we think well okay,
are there a set of outcomes? What are those outcomes?
Are they broad? Are they narrow?
Do we need know what the outcomes are?
If we have natural disasters could it be an earthquake?
In many parts of the world you have tornados,
cyclones that impact upon business;
what are the outcomes there?
Should you identify and try and manage those?
Well, clearly if you're a company that's operating in the American Gulf
and you have hurricanes every single year,
then you should be trying to identify and manage
the risks and deal with them.
There's also the probability of risk that you need to consider.
Are the risks easy to predict?
Well, if it's a tornado then you know they come every single year,
at the same time in the year, so you can predict them.
But what you can't do is you can't predict the outcome from the tornado.
We've had absolute disasters like hurricane Katrina,
and then you have other tornados that pass by without any impact.
So companies have to consider those.
And then you have the nature of the risk;
is it a quantitative risk?
So if you're doing business internationally
and you can quantify the sales that may go up or down
because of a particular risk; you can measure that.
You can measure commodity risk,
that's the price of gold, the price of oil.
So if you're using oil you can manage and measure
and model the changes in oil price and be able to work with that.
But there's a lot of other risks that are qualitative risks
that you can't actually measure or you can't measure
with any degree of certainty and one is environmental risk.
How do we measure that?
Reputational risk; how do you measure that?
You could come up with proxies,
but there are probably a number of proxies that
would be equally valid in this case.
So if you're a manager and you're running a business
then you need to be able to work with risk.
And a very good method of doing that is to use
a risk matrix, an impact matrix.
An what you do, it's just a two by two matrix.
You have on one side the probability that an event will occur,
or a risk factor will manifest itself.
And then on the other dimension you have its impact.
And you could split that into high and low probability,
high and low impact.
So if we can take the four different sections here.
So if you've got an event where there's
a very low probability that event will occur,
and in actual fact when it does occur
it doesn't actually have much of an effect on the company,
you actually just leave that alone, you just ignore it.
You don't need to bother with it.
Basically the cost involved of managing and measuring
that risk factor is much more than the impact
it would have on the company if something happened.
We can look at another case where you have a high probability
that events occur but low impact.
Now, that might be low level fraud,
or it might be inefficiencies or breakdowns in the quality control.
It might just be employees not being
at their desk all the time, small things.
Clearly if this is happening all the time you we need to deal with it.
But you put controls in place to make sure that
the events or the risk doesn't become a problem,
and it doesn't move towards the high impact side of that matrix.
Because if you've got a high probability of something happening
and the risk factor has a high impact on your business
then clearly you have to treat that as a priority for action.
And that is what managers do;
managers look at risk and they allocate them
into these four broad categories.
The one that I haven't mentioned is
the low probability / high impact.
That could be an earthquake in parts of the world.
If you take an example of San Francisco,
we know that it's prone to earthquakes,
we know that a major one occurs every 100 years,
there's a low probability that any one time an earthquake
will take place but when it does it's going to have a high impact.
So what would you do?
Well, businesses and regulators have actually put in place
controls, regulations for types of buildings that must be constructed,
that are earthquake-proof.
But they also have contingency plans,
and contingency plans are those plans that are implemented
when the event actually takes place,
so that you're managing the risk.
You can't avoid risk, so it's being able to deal with that risk,
and not just close your eyes and hope it never occurs.
So if we want to think about all the different risks
that a business faces,
you can put it into a broad, generic type of diagram like this,
where you've got the business model of the company
what the company actually does and the company operates in society.
And in society you have all these external factors
that put pressures onto your business model.
You've got social factors,
you've got the people that you're dealing with,
their work ethic, their approach to doing business.
Culture is very heterogeneous across the whole world,
and types of approaches in society is very different
in the Middle East than it is from South East Asia,
as it is from even within different parts of Europe.
Scandinavia has quite a different culture
from Southern Europe for example.
You also have the physical resources
in many parts of the world the physical resources are very scarce.
And in other parts of the world they're ubiquitous.
So if you need water then you run a business in Scotland.
You don't run a business that requires water
in a place that's drought prone.
And then you have the political climate,
how do the politics impact upon your business.
If you take an example of Repsol,
a big Spanish company and doing business in Argentina,
and last year Argentina just came in and took the whole company
and made it publically owned.
And that's working within politics and working within
the political climate that companies can't avoid.
Even in the UK you have the political pressure
that's put on companies at the moment to pay tax,
and to pay an appropriate amount of tax.
And this will impact upon all companies
as more and more governments are trying to draw in
tax revenues, clearly they're going to put pressure
on companies to make sure that an appropriate amount of tax is paid.
So if we go through the business risks
and we go through fairly quickly these risks,
as you study your business degree you're going to
clearly appreciate these a lot more
and study these in a lot more depth.
But you can look at all of these different factors here,
so if you look at the economic environment,
so you have credit risk, market risk, liquidity risk,
these are all risks that are associated with the economy.
We have something called systemic risk.
Systemic risk is a risk that something completely unrelated
to your business has an impact on your business.
So for example, if a plane crashes;
would that have an impact on your business
if you're a tourist business?
Then it may do.
People might lose confidence in a particular type of technology,
and that has an impact on what you do.
If you look under physical resources you see that
there are environmental risks, there's technological risks,
and then under the political climate you've got country risks
political risks, legal risks and accounting risks.
And we can then go through to social risks,
corporate governance, reputation, we have business risk,
we have industry risk.
So there are all these different risks that we have to face.
And as you can see from these slides under market risk
it's interest rates, so the impact that interest rates have
on the value of your company.
If interest rates go up how does that affect the value of your company?
What happens if they go down?
We've got commodity risk.
A lot of companies rely on oil as a major input into their business,
so what happens if the oil price goes up?
Does that have an impact on the value of your company?
If you're a multinational you'll be dealing with lots of different currencies,
so you'll be exposed to foreign exchange risk.
And if you're a bank or a financial institution you may have equity risk.
These are all what we'd call market risk.
Credit risk is the risk that a counterparty that you deal with
won't pay what they owe you.
And every company deals in something called trade credit,
and trade credit is like short term financing.
It's basically I'll sell you goods and you can pay
me back within three months.
What happens if they don't pay you back?
How do you approach that?
Liquidity risk is the risk you run out of cash.
Every company faces this,
they have to manage the cash and they have to make sure
that there's enough cash there to pay all their bills.
Otherwise the company may get into financial distress.
Operational risk looks at the operations of the company
and the risks that the company face.
It's up to the management of a company to make sure
that their operations are as efficient as possible,
and by operations we mean a number of things.
We mean the people, are they trained properly?
Do they have the right ethos, the right culture?
We talk about the business processes,
how are decisions made within companies?
We talk about the infrastructure, the actual property,
the plant, the equipment that a business uses;
is that fit for purpose?
And then we talk about the technology,
has the company got an appropriate level of technology
to run its business operations efficiently and properly?
Finally, there's always the danger of fraudulent activities.
And a company has to make sure that those are managed.
In different parts of the world these risks
may become greater or lesser;
it's up to the managers to deal with that.
We have legal regulatory risks,
this is becoming more and more important,
particularly in certain industries.
I would say the banking sector is a really big industry
that's been affected by regulation at the moment.
The risk that you don't comply with the regulations,
this could be quality control, it may be emissions,
it may be greenhouse gases, it may be to do with equality laws.
All of these have to be dealt with within a company.
We spoke already about reputational risk,
the risk that what you do affects your reputation
which will affect the value of your company.
And finally as a summary of the risks that we look at
risks are interconnected.
So I've got a diagram here that has credit risk,
the risk that a counterparty won't pay,
market risk, the risk that increases or decreases
in interest rates, foreign exchange, commodities,
and governance, there's a governance risk,
the risk that the way that you actually make decisions
in the company affects the value of the company.
These can all be interconnected,
so risks don't just sit on their own;
they're correlated with each other.
And as a manager you have to be able to model
that type of risk.
So how do you do it?
How do you manage risk in business?
Well, there's a three-stage plan or a three stage process
that you need to follow.
The first stage if identify those risks.
I would suggest that in a company
you get the senior management down,
you get the departmental leaders to sit down
and actually just brainstorm what are the major risks
that your company faces.
Once you've actually come up with a representative group
of important risks the next thing you ask is
well, how do we measure that risk?
How do we actually find a value of that risk?
That allows us to work out the exposure
that our company has to that risk.
And then once we know how exposed we are to the risk
we then have to put in place plans to manage that risk.
And that's a key thing; management of risks.
I've used an example here on the banking sector
but this can actually apply to any particular sector.
If you're running a company you deal with risk
but you could argue that well, you don't want any risk at all.
In fact, you want to run a business that has virtually no risk,
it's completely risk-free.
Well, if it's risk-free where's the value come in?
If you are running a business that's completely risk free
you're not going to generate any value.
Because you need to take on risk.
You could argue that well okay, let's just forget about risk.
Let's just do our business, let's just take on risks
because then we're going to get the highest possible return.
We want to maximise the return so we're going to take
all these extra risks.
Well, clearly that's irresponsible.
Eventually something bad is going to happen to you
and you'll be exposed.
So you have to find somewhere in-between.
You have to try and minimise the downside risk
the risk that bad things happen to you
and you try and maximise the upside risk,
the risk that good things happen to you.
And that's a key to managing businesses,
is the key to managing risk in business,
is being able to identify that.
And being able to set in place processes that
will allow you to efficiently run your business
that is optimised for risk.