A STUDY ABOUT RISK ANALYSIS WITH EXPLANATIONS AND A CASE STUDY

Authors Avatar

A STUDY ABOUT “RISK ANALYSIS” 

WITH EXPLANATIONS AND A CASE STUDY


ABSTRACT

This following report explain risk analysis, facilitated risk analysis process and its concepts and processes. Then it summarizes how risk can measure and control and an approach of risk analysis called as Simulation Approach. At the end, there is a case study to analyze how the risk analysis can apply in a case. Risk analysis is a technique to identify and assess factors that may jeopardize the success of a project or achieving a goal. This technique also helps to define preventive measures to reduce the probability of these factors from occurring and identify countermeasures to successfully deal with these constraints when they develop to avert possible negative effects on the competitiveness of the company. One of the more popular methods to perform a risk analysis in the computer field is called Facilitated Risk Analysis Process (FRAP). FRAP analyzes one system, application or segment of business processes at time. Risks come in all shapes and sizes; risk professionals generally recognize three major types. Market risk is the risk that prices will move in a way that has negative consequences for a company; credit risk is the risk that a customer, counterparty, or supplier will fail to meet its obligations; and operational risk is the risk that people, processes, or systems will fail, or that an external event (e.g., earthquake, fire) will negatively impact the company.

RISK ANALYSIS

CONTENTS:                                              PAGE NO:

  1. DEFINITION OF RISK ANALYSIS…………………………..1

  1. FACILITATED RISK ANALYSIS PROCESS……………….1

  1. CONCEPTS AND PROCESSES.............................................. 5

  1. RISK CONCEPT....................................................................... 6

  • Exposure
  • Volatility
  • Probability
  • Severity
  • Time Horizon
  • Correlation
  • Capital

   

  1. RISK PROCESSES..................................................................10

  1. RISK AWARENESS................................................................12
  • Set the Tone from the Top
  • Ask the Right Questions
  • Establish a Risk Taxonomy
  • Provide Training and Development
  • Link Risk and Compensation

   

  1. RISK MEASUREMENT...............................................................15
  • Losses
  • Incidents
  • Management Assessments
  • Risk Indicators

  1.   RISK CONTROL...................................................................................18
  • Selective Growth ot the Rusiness
  • Support Profitability
  • Control Downside Risks

   

  1.   RISK ANALYSIS AND THE SIMULATION APPROACH…..….22

  1.   CASE STUDY: THE PORT OF MOGADISCIO…………….....24

DEFINITION OF RISK ANALYSIS

Risk analysis is a technique to identify and assess factors that may jeopardize the success of a project or achieving a goal. This technique also helps to define preventive measures to reduce the probability of these factors from occurring and identify countermeasures to successfully deal with these constraints when they develop to avert possible negative effects on the competitiveness of the company.

One of the more popular methods to perform a risk analysis in the computer field is called Facilitated Risk Analysis Process (FRAP).

FACILITATED RISK ANALYSIS PROCESS

FRAP analyzes one system, application or segment of business processes at time.

FRAP assumes that additional efforts to develop precisely quantified risks are not cost effective because:

  • such estimates are time consuming
  • risk documentation becomes too voluminous for practical use
  • specific loss estimates are generally not needed to determine if controls are needed.

After identifying and categorizing risks, a team identifies the controls that could mitigate the risk. The decision for what controls are needed lies with the business manager. The team's conclusions as to what risks exists and what controls needed are documented along with a related action plan for control implementation.

Three of the most important risks a software company faces are: unexpected changes in revenue, unexpected changes in costs from those budgeted and the amount of specialization of the software planned. Risks that affect revenues can be: unanticipated competition, privacy, intellectual property right problems, and unit sales that are less than forecast. Unexpected development costs also create risk that can be in the form of more rework than anticipated, security holes, and privacy invasions.

Narrow specialization of software with a large amount of research and development expenditures can lead to both business and technological risks since specialization does not necessarily lead to lower unit costs of software. Combined with the decrease in the potential customer base, specialization risk can be significant for a software firm. After probabilities of scenarios have been calculated with risk analysis, the process of risk management can be applied to help manage the risk.

Methods like Applied Information Economics add to and improve on risk analysis methods by introducing procedures to adjust subjective probabilities, compute the value of additional information and to use the results in part of a larger portfolio management problem

CONCEPTS AND PROCESSES

   

Risks come in all shapes and sizes; risk professionals generally recognize three major types. Market risk is the risk that prices will move in a way that has negative consequences for a company; credit risk is the risk that a customer, counterparty, or supplier will fail to meet its obligations; and operational risk is the risk that people, processes, or systems will fail, or that an external event (e.g., earthquake, fire) will negatively impact the company.

   Other types of risk also have been suggested. Business risk is the risk that future operating results may not meet expectations; organizational risk is the risk that arises from a badly designed organizational structure or lack of sufficient human resources. In general, risk managers would consider market risk and credit risk as financial risk, and group all other risks as part of operational risk.

   And each of these broad risk types encompasses a host of individual risks. Credit risk, for example, includes everything from a borrower default to a supplier missing deadlines because of credit problems. Although there are commonalities and interdependencies between these risks, each ultimately requires specialized attention.

   How can a manager with responsibility for enterprise-wide risk hope to stay on top of all these various risks? It is impractical to simply hire an expert for every risk—since risk is a part of every business decision, this approach would require a risk manager for every business manager.

   A more practical solution is to make risk a part of every employee’s thinking and job responsibility. This has two advantages: first, no one is better placed to understand the risks of an activity better than those who specialize in that area; second, this approach means that risk is managed throughout the company.

   However, this requires a substantial effort in training and education. Many staff, whether junior or senior, will not be familiar with risk management, and particularly not with quantitative forms of risk analysis. Although these quantitative analyses are often very important, they are not practical for every type of risk and fall under the remit of the corporate risk management function.

General employees therefore need to be taught to recognize and assess risks in ways that are relatively easy to understand. Fortunately, there are a number of key risk concepts that will apply to the risks of any kind of business and must be addressed by any effective risk management program.

RISK CONCEPTS

   

Not all of the risk concepts described in this section can be readily (or meaningfully) quantified, particularly if operational risks are involved. As we’ll see, however, they are nonetheless important in understanding the nature of risk in any organization and should form the basis of the questions that a risk manager asks when assessing risk. Let’s consider them in turn.

Exposure

   What do I stand to lose? Generally speaking, the exposure is the maximum amount of damage that will be suffered if some event occurs. All other things being equal, the risk associated with that event will increase as the exposure increases. For example, a lender is exposed to the risk that a borrower will default. The more it lends to that borrower, the more exposed it is and the riskier its position with respect to that borrower. Exposure measurement is a hard science for some kinds of exposures—typically those that result in direct financial loss such as credit and market risk—but may be much more qualitative for others, such as reputational risk.

Volatility

   How uncertain is the future? Volatility, loosely meaning the variability of potential outcomes, is a good proxy for risk in many applications. This is particularly true for those that are predominantly dependent on market factors, such as options pricing. Volatility also has broader applications for different types of risk.

Generally, the greater the volatility, the higher the risk. For example, the number of loans that turn bad is proportionately higher, on average, in the credit card business than in commercial real estate. Nonetheless, it is real estate lending that is widely considered to be riskier, because the loss rate is much more volatile. Companies can be much more certain about potential losses in the credit card business—and prepare for them better—than they can in the commercial real estate business.

 Like exposure, volatility has a specific, quantifiable meaning in sorne areas of risk. In market risk, for example, it is synonymous with the standard deviation of returns and can be estimated in a number of ways. However, the general concept of uncertain outcomes also is useful in considering other types of risk: a spike in energy prices might increase a company’s input prices, for example, or an increase in the turnover rate of computer programmers might negatively affect a company’s technology initiatives.

Probability

How likely is it that some risky event will actually occur? The more likely the event is to occur—in other words, the higher the probability—the greater the risk. Certain events, such as interest rate movements or credit card defaults, are so likely that managers need to plan for them as a matter of course, and mitigation strategies should be an integral part of the business’s regular operations. Others, such as a fire at a computer center, are highly improbable, but can have a devastating impact. A fitting preparation for these is the development of backup facilities and contingency plans that will likely be used infrequently, if ever, but must work effectively if they are.

Severity

   How bad might it get? Whereas exposure is typically defined in terms of the worst that could possibly happen, severity is the amount of damage that is actually likely to be suffered. The greater the severity, the higher the risk. Severity is the partner to probability: if we know how likely an event is to happen, and how much we are likely to suffer as a consequence, we have a pretty good idea of the risk we are running.

   Severity wiil often be a function of other risk factors, such as volatility. For example, consider a $100 equity position. The exposure is $100, since the stock price could theoretically drop all the way to zero and all the money tied up in the stock could be lost. In reality, however, it is not likely to fall that far, so the severity is less than $100. The more volatile the stock, the more likely it is to fall a long way. The severity associated with this position is therefore greater, and the position more risky.

   As with our other risk factors, this way of thinking also can be applied to risks that are less easy to quantify. Consider, for example, the succession process after a key employee leaves or retires. Given that a change in management must occur at some point in time, and that the succession of new management will generally have a significant and potentially disruptive impact on the organization, it is alarming that companies don’t plan more carefully for this risk.

Time Horizon

   How long will I be exposed to the risk? The longer the duration of an exposure, the higher the risk. For example, extending a 10-year loan to the same borrower has a much greater probability of default than a 1-year loan. The time horizon also can be thought of as a measure of how long it takes (or, equivalently, how difficult it is) to reverse the effects of a decision or event.

   The key issue for financial risk exposures is the liquidity of the positions affected by the decision or event. Positions in highly liquid instruments such as U.S. Treasury bonds can usually be reduced or eliminated in a short period of time, while positions in lightly traded securities or commodities such as unlisted equities, structured derivatives, or real estate take much longer to sell down. For operational risk exposures, the time horizon can be thought of as the time required for the company to recover from an event. A fire that burns a computer center to the ground will leave a company exposed during the time before backup facilities come online—much greater risk if such backup procedures are not well tested.

   Companies usually have little control over the level of market liquidity, or over many of the events that lead to operational risks. However, they do have some control over their effects. Problems arise when companies do not recognize that a risk event has occurred, are not aware of the time horizon associated with that risk, and/or have not developed a contingency plan.

Correlation

   How are the risks in my business related to each other? If two risks behave similarly—they increase for the same reasons, for example, or by the same amount—they are considered highly correlated. The greater the correlation, the higher the risk. Correlation is a key concept in risk diversification. Highly correlated risk exposures, such as loans to the same industry, investments in the same asset class, or operations within the same building, increase the level of risk concentrations within a business. Thus, the degree of risk diversification in a business is inversely related to the level of correlations within that business. With financial risks, diversification can be achieved through risk limits and portfolio allocation targets, both of which are designed to reduce risk concentrations. With operational risk, diversification can be achieved through separation of operational units or redundant systems.

Capital

   How much capital should I set aside to cover unexpected losses? Companies hold capital for two primary reasons. The first is to meet cash requirements, such as the costs of investments and expenses. The second is to cover unexpected losses arising from risk exposures. The level of capital that management wants to set aside for risk is often called economic capital.

   The overall level of economic capital required by a company will depend on the institution’s target financial strength (e.g., target credit rating). The more creditworthy the company wants to be, the more capital it will have to hold against a given level of risk. This is fairly intuitive: a credit rating (or the concept of creditworthiness in general) is an estimate of how likely a company is to fail. Clearly, it is less likely to fail if it has more capital to absorb any unexpected loss. So a company that wants a triple-A credit rating will have to hold far more capital against a certain set of risks than another company that has the same risks but is satisfied with a subinvestment grade rating, such as double-B.

   The concept of economic capital also applies to the individual business units within a company. Those business units that run greater risks (and therefore stand more chance of losing money) will have to be allocated more economic capital if they are to comply with the firm’s overall target credit worthiness. The allocation of economic capital to business units has two important business benefits.

   First, it links risk and return explicitly. Higher allocations of economic capital require business units that take more risks to compensate by generating greater profits. Second, economic capital allows the profitability of all business units to be compared on a consistent risk-adjusted basis. As a result, business activities that contribute to, or detract from, shareholder value can be identified easily, and so management has a powerful and objective tool to allocate economic capital to its most efficient users. In effect, this creates an “internal capital market” where good businesses will grow and bad businesses will die.

RISK PROCESSES

   An appreciation of the risk concepts described above is the first step in a clearer understanding of risk. This understanding in turn supports the first step in any risk management process: risk awareness. The second step is to measure risk; the third, to control it. For all the quantitative sophistication that can be thrown at it, risk management is still ultimately carried out by people, and the three parts of a corporate risk management process can usefully be illustrated in terms of the ways that people manage risks in their evervday lives.

   First, risk awareness. Most people think (at least a little!) about what they are currently doing and what they plan to do next; accidents happen when they misjudge an unfamiliar situation or fail to pay sufficient attention to a seemingly familiar one. People break legs when they first go skiing and cut their fingers when they drift off while chopping vegetables.

   Companies obviously don’t think in this way, but they do need to use the collective intelligence of their management and staff to think through the risks consequent upon the company’s current and proposed activities. (Once again, we return to the need to anticipate and learn from mistakes). Promoting risk awareness should be the starting point for any risk management process. Half the battle is already won if people can be successfully encouraged to consider the risks involved in their activities, and to understand their roles and responsibilities in managing them. Mistakes can then be avoided or quickly corrected.

   Awareness alone is not enough, however. It is one thing to know that a potential risk exists; it is another to know when it becomes a real threat and how serious it is. A person might see a distant threat (a car bearing down from a distance), or feel an immediate one (a tack in the foot). The scale and speed of his reaction will differ.

Join now!

   Similarly, a company must be able to recognize changes in its operating environment that signal potential risks and must also notice when a part of the company is unexpectedly afflicted by some event. That means effective transmission of information into and through the company, which in turn implies the need for efficient communications technology and clear, consistent reporting of risks (i.e., risk measurement).

   Having identified and quantified the risk, a person must decide if any thing should be done about it (i.e., risk control). A person might control his risks in a number of different ways. He might ...

This is a preview of the whole essay