Once the strategic objectives have been broken down into more tactical, manageable pieces, risk managers need to use the strategy document, financial model, business plan or the budgeting model to determine key assumptions made by the management.
Most assumptions are associated with some form of uncertainty and hence require risk analysis. Risk analysis helps to put unrealistic management assumptions under the spotlight.
Common criteria for selecting management assumptions for further risk analysis include:
- The assumption is associated with high uncertainty.
- The assumption impact is properly reflected in the financial model (for example, it makes no sense to assess foreign exchange risk if in the financial model all foreign currency costs are fixed in local currency and a change in currency insignificantly affects the calculation).
- The organisation has reliable statistics or experts to determine the possible range of values and the possible distribution of values.
- There are reliable external sources of information to determine the possible range of values and the possible distribution of values.
For example, a large investment company may have the following risky assumptions: the expected rate of return for different types of investment, an asset sale timeframe, timing and the cost of external financing, rate of expected co-investment, exchange rates and so on.
Concurrently, risk managers should perform a classic risk assessment (as per the process outlined in ISO31000:2018) to determine whether all significant risks were captured in the management assumptions. The risk assessment should include a review of existing management and financial reports, industry research, auditors’ reports, insurance and third-party inspections, as well as interviews with key decision makers.
By the end of this step risk managers should have a list of management assumptions. For every management assumption identified, risk managers should work with the process owners, internal auditors and utilise internal and external information sources to determine the ranges of possible values and their likely distribution shape.
Check out other risk management books
RISK-ACADEMY offers online courses
Informed Risk Taking
Learn 15 practical steps on integrating risk management into decision making, business processes, organizational culture and other activities!
ISO31000 Integrating Risk Management
Alex Sidorenko, known for his risk management blog http://www.riskacademy.blog, has created a 25-step program to integrate risk management into decision making, core business processes and the overall culture of the organization.
Advanced Risk Governance
This course gives guidance, motivation, critical information, and practical case studies to move beyond traditional risk governance, helping ensure risk management is not a stand-alone process but a change driver for business.
Alex, I’ve been following your blog for sometime now. I wonder if you have articles on risk assessments conducted on new power generation sources like solar, wind and other renewables
Hi Duncan, thank you. I don’t have articles on specific industries, not yet at least. Risk assessments for any industry are ultimately the same. What is the decision your management is trying to make? Because risk assessment without a decision is probably a waste of time