Conceptually, risk is any uncertainty that may be harmful to the ability to successfully implement the business objectives of the enterprise. Businesses can identify potential risks to manage them. Fully understood, risk management is a process of a comprehensive review of the business operations to identify potential risks that may impact adversely to the operational aspects of the business. Based on that, the response solutions will be given corresponding to each risk. We can also understand that the risk management process is a process that is organized in a formal way and ongoing to determine, control and report the risks that can affect the achievement of the business objectives of the enterprise.
Requirements for operational risk management
To ensure that risk management activities are carried out as planned, the implementation must ensure the following requirements:
• Raising awareness about the risks as well as the ability to cope with risks appropriately throughout the enterprise;
• Formalize the process of risk management;
• Develop unified risk management processes in the enterprise;
• Transparency risks;
• Including
risk management process as part of the internal control system;
In fact, well organized and efficient risk management activities will contribute to add value to the enterprise, specifically:
• Help improving operational efficiency and create competitive advantage;
• Contribute to the allocation and efficient use of corporate resources;
• Minimize errors in all aspects of business operations…
Recently, with the powerful impact of high inflation rate and economic recession caused by the global financial crisis to enterprises, people are concerning more about risk management activities. Many experts believe that well organized and effective operated risk management system will help businesses withstand and overcome fluctuations.
However, how to organize a complete risk management system is the fact that not many businesses are well understood. The worrying thing is many businesses supposing that with the use of insurance services, their businesses are making adequate risk management. That is completely incorrect.
To establish risk management systems, enterprises should start from the development of risk management policy. This policy will define the approaching and managing of risk. In addition, risk management policies will clearly defined responsibilities for risk management throughout the enterprise to Board of Directors; The subordinate units; Departments; Risk management department (if any); the internal audit department – internal control. The implementation of risk management activities should be tied to business strategy, annual budget plan and the business cycle in the enterprise.
Risk Management Process
Basically, risk management processes typically include basic steps such as: confirmation of the business objectives, identify risks, description and classification of risk, assessment and risk ratings, response planning development, reporting an update on implementation, monitoring the process of implementation, review and improvement of risk management processes. Details of some of the main steps in the risk management process are as follows:
Confirmation of business objectives
Risk management activities are organized and implemented towards ensuring the successful implementation of the enterprise objectives. Therefore, at the begining the risk management process, the first task that business leaders need to do is confirming the operational goals of the business. This will be the base to ensure that risk management activities are held in the right direction.
Identify Risks
There are many methods to identify risk. Each method has different advantages and disadvantages. However, the following methods are considered using to determine the risk:
· Organize risk assessment workshop;
· Organize “Brain Attack” meeting;
· Questionnaire;
· Audit and inspection;
· Based on industry norms;
· Situation analysis
In fact, the method of determining risk that are used most in organizations is organizing risk assessment workshop. Attending the workshop are the Board of Directors and leaders of all departments. Members at the workshop will exchange information to give a list of business risks. In many cases, the result of the risk identification process is a long list of potential risks. However, this should not be too worried, the implementation of the next steps of the risk management process will help identify clearly the risks that are really the great risk to enterprises.
Description and classification of risk
After identifying potential risks, the next step is to describe briefly but specifically about the origin, cause, consequence and impact of each risks to the enterprise.
Next, we will implement the risk classification. There are many different types of potential risks for enterprises. They can originate inside or outside the enterprise. Based on the nature of the risk, they are many way to classify risk. However, the most common way is to classify risk into 4 groups as follows:
· Financial risk: interest rate, exchange rate, credit source, cash flow and ability to pay…;
· Strategic risk: competition, customer changes, industry changes, risks for research and development activities, intellectual property…;
· Operational risk: the leaders, corporate culture, violation of management rules, financial control, information systems…;
· Dangerous risk: environmental risks, supplier, natural disaster, risks for assets, contracts, products and services…
The classification of risks as above will help enterprises to manage risk in a systematic way.
Assessment and risk rating
Enterprise resources are limited while the number of the risks is great. So, the next step is to organize, evaluate and ranking risks according to priority level of response. Enterprises will analyze, evaluate each risk according to two criteria: the possibility of risk and the extent of the risks affecting the business if happened. The risk that the businesses need to prioritize response and prevent is the risk with high likelihood and degree of influence.
Develop response plans
Develop response plans is an important stage in the process of risk management. At this stage, enterprise should given the preventive measures and specific control should be taken to prevent and minimize damage if the risk occurs. There are 3 contents that must be determined for each specific risk when developing response plans:
1. Measures that should be implemented to prevent risks;
2. The completion deadline for those measures;
3. The person that responsible for managing that risk.
Monitoring the implementation of measures
In the process of implementation of response measures, businesses need to build a system of reporting regularly to ensure strict control of the implementation process. Enterprises also need to ensure that all shortcomings in the implementation of risk control measures must be timely reporting to leaders.
At the same time, business leaders must also build a culture of risk management to every staffs in the enterprise. It is high time that the corporate governance should seriously view the role of risk management activities, consider setting up and maintaining a risk management system in business. Practical experience shows that, once the risks are forecasted, enterprises can fully develop and deploy effective response plans for sustainable development.
