1

Risk Management Plan

Student’s name

Student’s ID number

Institutional Affiliation

Professor’s Name

Date of Submission
 2

TABLE OF CONTENTS

Page No.

I. Introduction of the Problem 3

II. Risk management process 3

a. The Organization’s Strategic Objectives 4

b. Risk Assessment 4

1. Risk Analysis 4

2. Risk Identification 5

3. Risk Description 6

4. Risk Estimation 7

5. Risk Evaluation 8

c. Risk Reporting 8

d. Decision 9

e. Risk treatment 9

f. Residual risk treatment 10

g. Monitoring 10

III. Conclusion 11

References 11
 3

I. INTRODUCTION

Sunbucks is a coffee retailer company established 10 years ago with five store branches in

City A. It offers several blends of coffee, handcrafted beverages, and other related merchandise

and food items. The company established its strong customer base in prime locations, and its

huge success was evident across the neighboring cities. Because of its continued success and

smooth operations, Sunbucks' leaders decided to open its first branch in City B, the second-

largest city in the United States of America.

Opening a new branch in a different location may not be as easy as opening the first five

Sunbucks branches in the same city. While the growth and success of the coffee company are

evident in City A, there is no guarantee that it will have the same level of acceptance in City B.

Although the customers may share similar characteristics, distinctions still have to be considered.

These factors may include the rate of competition, customers' preferences, and even the financial

and legal requirements that the company should address. Opening a new branch in a new

location will be like starting a new business with a competitive edge. Nevertheless, this business

decision comes with risks, and thus, a risk management plan should be in place. According to

Hopkin (2018), risk management inputs are required not only for strategic decision-making but

also for the effective delivery of projects and programs of work and for the organization's routine

operations.

I. RISK MANAGEMENT PROCESS

The following plan was made using the IRM risk management process and the PACED

framework. It likewise considered the 8Rs and 4Ts of risk management (Hopkin, 2018), which

identifies, analyzes, evaluate, treat, monitor, and review the risks. Integrating the different risk
 4

management steps, the case of Sunbucks was critically assessed and analyzed, as reflected by the

process breakdown presented below.

a. The Organization’s Strategic Objectives

The business decision to open another branch in another city is driven by the aspiration to

increase profit and widen the customer reach. As any company aspires to become, Sunbucks

aims to stay in the competitive arena of the coffee retail industry and to go across borders of the

national setting. The move to expand the business to another city is a jumpstart of its long-term

goal to become known in the international market and to become a multinational company in the

future. With the increase in its customer base, Sunbucks believes it has already prepared to gain a

bigger market share.

b. Risk Assessment

b.1. Risk Analysis

The first and most important stage in the assessment is risk analysis. It is crucial that the

potential risks of opening a new branch in another city be properly analyzed. Conduct of research

and case studies, comparison to the current market, and scenario analysis are all useful tools for

identifying potential risks and assessing their severity. Significantly, the results of a SWOT

analysis can serve as the basis for business decisions.

In the risk analysis, both external and internal stakeholders are analyzed from the risk

perspective. Internally, the company needs to address concerns regarding the human resource.

Since the branch is in a different city, it would require a new set of employees to be outsourced

using the preferred staffing approach. While there could have already been set standards in the

present branches, adjustments shall be made to fit the new business environment. The going-rate
 5

salary needs to be carefully assessed to provide career opportunities, enabling the company to

have qualified individuals with the required knowledge and skills. In doing so, the financial risks

should also be properly calculated since the decision bears heavy financial influences. The

starting capital of the new branch would take a toll on the company's finances. Hence the

revenue could not become stable in the beginning. However, additional branches could be an

avenue toward greater profits and income for the company.

Opening a new branch in a new geographical location would also mean involving a

different type of external stakeholders. For instance, government regulations may be different,

specifically regarding local business policies implemented in the new location. There could also

be different standards in the coffee retail industry in City B that are not experienced in City A. It

is also significant to assess the level of competition as the threat of rivalry seemed to be greater

in the target location. Hence, a comprehensive assessment of the industry landscape needs to be

done to analyze and identify the risks properly.

b.2. Risk Identification

Risk Identification is the next step in risk assessment. Having analyzed both external and

internal needs in the new business environment, the potential risks could already have been

identified. For example, positive and negative risks could be found in the proposed opening of

the new Sunbucks branch in a different city.

Having adequate financial support for the project is crucial. Hence one of the most

significant risks is insufficient financing. Since there are already five branches that are run by the

company, starting a new one would mean that funds will be allocated to it without immediate

return. The new branch to be opened will be like testing the water stage and could not provide
 6

immediate revenue to the company. Hence, finances should be managed accordingly. Secondly,

there could also be legal risks that Sunbucks has to face. Going out of the city's borders would

mean studying and abiding by the localized policies and regulations, particularly in the coffee

retail industry. In addition, there are necessary permits that have to be received by the company.

Aside from this, employees should also be rewarded with certification for food handling, which

could affect the staffing process and business operations as a whole.

Another negative risk that could affect the success of the new Sunbucks in a new location

is in terms of supply chain management. Suppliers of City A branches may deal with a shortage

with the additional branch, and additional expenses would be incurred due to its transport.

Another negative risk that could affect the success of the new Sunbucks in a new location is in

terms of supply chain management. Suppliers of City A branches may deal with a shortage with

the additional branch, and additional expenses would be incurred due to its transport. Lastly,

there could also be risks in terms of customer satisfaction. Long queues and even the quality of

products may affect patronage.

Meanwhile, it is equally important to identify positive risks that the project can bring to

the company. For example, widening the reach of the products and services of Sunbucks would

make it more established and give it a better place in the market. In addition, if successful, the

first branch in City B could be the starting point of further business expansion in the United

States and worldwide.

b.3. Risk Description

All four types of risks are present in the project. The implemented policy and other

regulatory mandates that affect a company pose a compliance risk. Therefore, it was important
 7

for management to recognize potential compliance issues and implement changes to the business

as necessary to meet applicable standards. The new location may also pose a hazard risk as there

could be accidents and injuries during business operations. As employees will be involved in

food handling, some accidents may occur while performing their duties.

In the same way, adverse effects of coffee and food items on consumers should also be

looked out for. Hence, control risks should also be addressed as management needs to strengthen

security and safety. However, opening a new branch also serves as an opportunity. As such, this

type of risk can be seen as an opportunity, as it allows the company to make necessary

adjustments to its plans to increase the likelihood of its success in the new city. The new location

needs to increase market share and generate long-term projects and revenue to succeed.

b.4. Risk Estimation

In the risk estimation stage, threats and opportunities and their associated probabilities

are recorded and considered. It is more important to account for and plan for a risk with a high

threat consequence and a high probability of occurrence than it is for a risk with a low threat

level and a low probability of occurrence. These phases help determine which risks should be

avoided entirely because of their potentially catastrophic effects and receive appropriate attention

from the appropriate stakeholders. The estimation produces numeric as well as qualitative

results. For example, the city where the branch is located may have its own rules and regulations.

This must be accepted and acted upon.

Similarly, adapting the going-rate salary for employees in the new city should be done to

establish a strong human resource. In terms of competition, it could be an excellent way to

 8

develop new skills and make a way to make a name in the competitive coffee retailer industry.

Losses can be mitigated by planning ahead and allocating sufficient funds to cover expenses.

b.5. Risk Evaluation

The analyzed, identified, described, and estimated risks were compared to the current level

of acceptance and the situation in the risk evaluation stage. The company should have risk

criteria in order to appropriately evaluate the risks and their influence on the business operations.

Since this is a pioneering effort in a new location, unanticipated consequences must be factored

in. Factors such as legal constraints, stakeholder interests, long-term viability, and the capacity to

prevent, mitigate, and facilitate risks were taken into account during the risk evaluation. In this

step of risk management, the company will identify how the risks will affect specific contexts

and the interests of key players.

c. Risk Reporting

In the risk reporting phase of risk management, risks were recorded and communicated to

ensure that all parties understood their potential impact. Reporting ensures that risks are

effectively managed and corresponding personnel is informed about them. During the reporting

phase, a risk register and risk protocols are created to help make the best decision. It serves as the

company's basis for deciding between them. In addition, it is ensured that all identified and

evaluated risks are reported to account for their potential influence on the project's success.

Following the plan-implement-measure-learn structure, the evaluation phase establishes

classification systems and management guidelines that may be modified during residual risk

reporting and monitoring. Reporting also allows for input from both internal and external

stakeholders. Risk protocols facilitate subsequent decision-making because rules and procedures
 9

address various types of risks using available resources and methods. Protocols outline

evaluation procedures, resource allocation, planning requirements, objectives, and assurance

systems.

d. Decision

In the decision stage, the company selects actions towards the risks that have been

analyzed, identified, described, estimated, and evaluated. The decision should help the company

reach its goals and should be evaluated against the risk protocols. The decision should be made

after considering the risks, the company's predetermined guidelines, and any available

opportunities.

e. Risk treatment

Since all types of risks have been identified in the project of Sunbucks, the risk treatment

will adopt the 4Ts (tolerate, treat, transfer or terminate). The risk treatment stage focuses on

implementing the appropriate action towards the risk. As it was mentioned by Hopkin (2018),

there is a specific treatment for each kind of risk. For example, compliance risks are to be

minimized. Hence, the risk of an uncertified food handler may be minimized by including food

handling certification in the application requirements. This will lessen the company's problem of

dealing with the certification process. Some other compliance risks, such as those that may

come from the legal requirements and compliances, may be minimized by hiring and

designating skilled individuals to process such matters.

Meanwhile, hazard risks shall be mitigated, and control risks will be managed. These types

of risks may be in the case of stiff competition, but with proper control and mitigation, such

risks may be lessened. In addition, offering a better customer experience will give the company
 10

some edge in the competitive coffee retail industry. Lastly, opportunity risks shall be embraced.

After estimating and evaluating the risks, it became clear which ones needed more attention and

how to allocate the available resources; this is the knowledge gained from the risk identification

and analysis step.

f. Residual Risk Reporting

After the decision and risk treatment have been applied, residual risk may still be identified

and reported. In the residual risk reporting stage, risks that persist even after all the efforts to

identify and eliminate are made will be identified. There are a few reasons why residual risk

matters. First, it's important to keep in mind that residual risk is the risk that remains after all

other security measures and productivity improvements have been implemented. Given the

options available for reducing risk, organizations may be forced to accept some level of residual

risk. Compliance and regulatory requirements are other motivating factor to take residual risk

into account. In the case of Sunbucks, compliance risks may become a residual risk. Finally, it is

important to calculate residual risk to prioritize the appropriate security controls and processes.

g. Monitoring

The success of the risk management process will only be determined by assessing how far it

was implemented and identifying necessary improvements in the different stages. Monitoring is

the final stage where risk management implementers will be able to measure and evaluate the

outcomes. It is also where the necessary adjustments will be made based on the performance of

different processes. Hence, both formal audits and modifications may be made in this stage. In

the monitoring stage, future business decisions may be drawn out based on their effectiveness.

For instance, it has been found that finding supplier in the nearby area is more advantageous
 11

than having those in City A. Therefore, Sunbucks could further strengthen its linkages with

nearby suppliers who can also provide raw materials in the future branches that they will open in

the same area.

II. CONCLUSION

In conclusion, the business decision of Sunbucks may bring all four types of risks. There

are compliance risks since the new geographical location would surely have its own policies and

standards that the company has to abide by. There are also hazard risks and unforeseen

circumstances that could be a result of the project. Uncertainty risks are also possible as the

success of the branches in City A may not be the same in City B. But most importantly, the

project is more of an opportunity risk since it could pave the way to more business expansion in

different parts of the world. Hopkin (2018) said that risk should not be avoided but should be

calculated to achieve greater success.

Reference

Hopkin, P. (2017). Fundamentals of risk management: Understanding, evaluating and

implementing effective risk management (4th ed.). Kogan Page Publishers.