STRATEGIC

MANAGEMENT
By
Muhammad Waqas Chughtai
Part E: Chapter - 15
Risk Management

©Prepared by Muhammad Waqas Chughtai

In this chapter you will learn:
▪ Risk Management
✓ Meaning of Risk
✓ Risk Management
✓ Approaches to Controlling Risk
✓ Proactive Vs Reactive Strategies
✓ Risk Audit
✓ Financial Risk Management
✓ Risk Management of a Limited Company

©Prepared by Muhammad Waqas Chughtai

1. Meaning of Risk

©Prepared by Muhammad Waqas Chughtai

1.1 Meaning of Risk
◦ The meaning of RISK is possibility of loss or
injury.
◦ Risk involves uncertainty about the
effects/implications of an activity with
respect to something that humans value
(such as health, well-being, wealth,
property or the environment), often
focusing on negative, undesirable
consequences.

©Prepared by Muhammad Waqas Chughtai

1.2 Risk Vs Uncertainty
◦ Risk is usually associated with situations where the probabilities of
different outcomes can be estimated or calculated. In other words,
you have some data or information that allows you to assign
probabilities to potential outcomes.
◦ Example of Risk:
◦ Like a Roll of Dice: Imagine you're rolling a fair six-sided
die. You know there are six possible outcomes (1, 2, 3,
4, 5, 6), and each has an equal chance of happening.
That's a situation with risk. You can measure and
predict the likelihood of each outcome because you
have clear information.
©Prepared by Muhammad Waqas Chughtai
1.2 Risk Vs Uncertainty
◦ Uncertainty, on the other hand, arises when there is a lack of information
or data to estimate probabilities. In uncertain situations, the range of
possible outcomes may be unknown or difficult to measure.

◦ Example of Uncertainty:
◦ Like a Mystery Box: Now, think of a mystery box where
you can't see what's inside, and you have no idea what
could come out. You don't know the possibilities, and
you can't assign probabilities because it's
unpredictable. This is more like uncertainty, where the
future is unclear, and you lack information to make
precise predictions.
©Prepared by Muhammad Waqas Chughtai
1.3 Why incur Risk?
◦ Opportunity for Reward
◦ Competitive Advantage
Incur Risk
◦ Innovation and Creativity
◦ Market Expansion
Gain Competitive Increase Financial
◦ Strategic Objectives Advantage Return
◦ Adaptation to Change

©Prepared by Muhammad Waqas Chughtai

Example: A-Bites Bakery
◦ To grow the business and stay competitive, Ahsan decides to take on some
calculated risks:
◦ Introducing New Products:
◦ Risk: Developing and introducing a line of unique and innovative pastries that his
customers haven't seen before.
◦ Reason: By taking this risk, he aims to attract new customers who are looking for
something different and stand out from other local bakeries.
◦ Expanding to a New Location:
◦ Risk: Opening a second branch in a different neighborhood to reach a new
customer base.
◦ Reason: He incurs this risk to expand his market presence, increase sales, and
potentially become the leading bakery in multiple areas.

©Prepared by Muhammad Waqas Chughtai

◦ Investing in Marketing and Advertising:
◦ Risk: Allocating a significant portion of budget to marketing campaigns, such as
social media advertising and promotions.
◦ Reason: The goal is to increase brand visibility, attract more foot traffic to his
bakery, and generate higher sales. The risk is that the marketing investment may
not guarantee immediate returns, but it's a calculated risk for potential long-term
gains.
◦ Hiring and Training Staff:
◦ Risk: Bringing in new employees and investing in their training to improve service
quality.
◦ Reason: This risk is taken to enhance customer experience, handle increased
demand, and ensure the bakery's sustainability. It involves short-term costs but
with the potential for long-term benefits in terms of customer satisfaction and
loyalty.

©Prepared by Muhammad Waqas Chughtai

2. Risk Management

©Prepared by Muhammad Waqas Chughtai

2.1 Risk Management
◦ Risk management is a systematic process of identifying, assessing,
prioritizing, and mitigating risks in order to minimize the impact of
uncertainties on the achievement of organizational objectives.
◦ Process of Risk Management
Step 1: Identify the Risk
Step 2: Analyze the Risk
Step 3: Evaluate the Risk or Risk Assessment
Step 4: Treat the Risk
Step 5: Monitor and Review the Risk

©Prepared by Muhammad Waqas Chughtai

2.2 Risk Management Process
1. Identify the Risk
◦ Think about and list all the things that could go wrong or cause problems. These are
potential risks. For example, in a project, it could be things like bad weather,
unexpected costs, or team members getting sick.
2. Analyze the Risk
◦ Once you've identified the risks, try to understand them better. Figure out how likely
they are to happen and what kind of impact they might have. For instance, ask
yourself, "How bad would it be if this risk actually occurred?“
3. Evaluate the Risk or Risk Assessment:
◦ This step is about ranking the risks. Which ones are more likely to happen, and which
ones would have a bigger impact? This helps you focus on the most important risks
first.
©Prepared by Muhammad Waqas Chughtai
Risk Appetite ???
Risk Tolerance ???
Cont. Risk Management Process
4. Treat the Risk:
◦ Now that you know which risks are the most serious, you need to do something
about them. This could mean taking steps to prevent the risk, having a backup plan,
or finding a way to reduce the impact if it happens.
5. Monitor and Review the Risk:
◦ After you've dealt with the risks, it's important to keep an eye on things. Check if the
risks are still there, or if new ones have come up. Also, review how well your actions
to manage the risks are working.

©Prepared by Muhammad Waqas Chughtai

Example: A small business that sells handmade products.
1. Identify the Risk:
◦ The business owner identifies potential risks. These could include things like a
supplier running out of materials, an increase in production costs, or a key
employee leaving unexpectedly.
2. Analyze the Risk:
◦ The owner analyzes each risk. They think about how likely it is that the supplier
might run out of materials and how much it would cost to find an alternative. They
also consider the impact of a sudden increase in production costs on their profits.
3. Evaluate the Risk or Risk Assessment:
◦ After analysis, the owner ranks the risks. They decide that the supplier running out
of materials is a high-risk, high-impact event, while a minor increase in production
costs is a lower-risk, moderate-impact event.

©Prepared by Muhammad Waqas Chughtai

4. Treat the Risk:
◦ For the high-risk event, the owner decides to build relationships with multiple
suppliers to ensure a steady flow of materials. They also negotiate contracts to lock
in prices. For the lower-risk event, the owner keeps an eye on costs but doesn't take
immediate action since the impact is manageable.
5. Monitor and Review the Risk:
◦ The owner continuously monitors the supply chain, keeping in touch with suppliers
and adjusting plans if necessary. They also periodically review production costs to
ensure they remain within acceptable limits. If a new risk, like a sudden increase in
shipping costs, emerges, the owner goes through the process again.

©Prepared by Muhammad Waqas Chughtai

3. Approaches to Controlling Risk

©Prepared by Muhammad Waqas Chughtai

3.1 Approaches to Controlling Risk
◦ Controlling risk is a critical aspect of various domains, including finance, project
management, healthcare, and more. Different industries and situations may require
tailored approaches, but here are some general strategies and approaches to
controlling risk
◦ TARA (SARA) Framework of Risk Management
◦ Risk Transfer (Sharing):
◦ Definition: Shifting the risk to another party, typically through insurance or
outsourcing.
◦ Example: Purchasing insurance to transfer the financial risk of a specific
event.

©Prepared by Muhammad Waqas Chughtai

Cont. Approaches to Controlling Risk
◦ Risk Avoidance:
◦ Definition: This involves avoiding activities that could lead to potential risks.
◦ Example: If a company identifies a high-risk market, it may decide not to enter that
market.
◦ Risk Reduction:
◦ Definition: Implementing measures to decrease the probability or impact of identified
risks.
◦ Example: Installing fire suppression systems in a building to reduce the risk of fire.
◦ Risk Acceptance:
◦ Definition: Acknowledging the risk and accepting the potential consequences without
taking specific actions to mitigate it.
◦ Example: A company might decide not to invest in risk reduction measures for a low-
impact, low-probability event
©Prepared by Muhammad Waqas Chughtai
Cont. Approaches to Controlling Risk
Other Approach
◦ Risk Hedging
◦ Definition: Hedging is a strategy to protect against the potential adverse
effects of price fluctuations, uncertainties, or risks. It often involves taking a
counterbalancing position to offset the potential losses from an existing
position.
◦ Example: In the commodities market, a company may use futures contracts
to hedge against the risk of price fluctuations. By locking in a future price,
the company can protect itself from adverse movements in the market.

©Prepared by Muhammad Waqas Chughtai

4. Proactive Vs Reactive Risk
Management Strategies

©Prepared by Muhammad Waqas Chughtai

4.1 Proactive Vs Reactive Risk Mngt Stg.
Proactive risk management involves taking anticipatory measures to
identify, assess, and mitigate potential risks before they occur.
Examples:
◦ Scenario Planning: Creating hypothetical scenarios to prepare for
various potential risks.
◦ Regular Audits: Conducting regular audits to identify and address
compliance and operational risks.
◦ Training and Education: Providing training to employees to enhance
their skills and awareness of potential risks.

©Prepared by Muhammad Waqas Chughtai

4.1 Proactive Vs Reactive Risk Mngt Stg.
Reactive risk management involves responding to risks after they have
occurred, with a focus on minimizing damage and restoring normal
operations.
Examples:
◦ Incident Response Plans: Developing plans for specific types of
incidents.
◦ Insurance Coverage: Obtaining insurance to cover potential losses.
◦ Post-Incident Analysis: Analyzing the causes of incidents to prevent
similar ones in the future.

©Prepared by Muhammad Waqas Chughtai

5. Risk Audit

©Prepared by Muhammad Waqas Chughtai

5.1 Risk Audit
◦ A risk audit involves identifying and assessing all risks so that a plan can be put
in place to deal with any occurrence of any undesirable event which causes
harm to people or loss for the organization.
◦ Process of Risk Audit
◦ 1. Identifying Risks:
◦ First, you figure out what could go wrong. This involves looking at different
aspects of a project, operation, or situation to find potential issues.
◦ 2. Assessing Risks:
◦ Once you've identified risks, you evaluate how likely they are to happen and
what their impact might be. This helps prioritize which risks are most
critical.

©Prepared by Muhammad Waqas Chughtai

Cont. Risk Audit
◦ 3. Documentation:
◦ Write down all the identified risks and their details. This creates a record
that can be referred to later.
◦ 4. Analyzing Controls:
◦ Check what safeguards or controls are already in place to manage or
mitigate these risks. This step helps understand how well-prepared you are
to handle potential problems.
◦ 5. Recommendations:
◦ If the existing controls are not enough, suggest ways to improve them or
propose new strategies to deal with the risks. These recommendations aim
to enhance the overall risk management approach.

©Prepared by Muhammad Waqas Chughtai

Cont. Risk Audit
◦ 6. Implementation:
◦ Once recommendations are accepted, put them into action. This could
involve changes in processes, adding safety measures, or any other actions
that reduce the likelihood or impact of identified risks.
◦ 7. Monitoring:
◦ Regularly keep an eye on how well the risk management measures are
working. If there are new risks or if the situation changes, adjustments may
be needed.
◦ 8. Reporting:
◦ Communicate the findings, actions taken, and the overall status of risk
management to relevant stakeholders. This ensures transparency and keeps
everyone informed.
©Prepared by Muhammad Waqas Chughtai
Example: Sugar Manufacturing Company
◦ Identifying Risks:
◦ Imagine the sugar manufacturing company wants to expand its production
capacity. Risks could include potential supply chain issues, such as a shortage of
raw materials (like sugar cane), or technical problems in the production process.
◦ Assessing Risks:
◦ The company assesses the likelihood of a raw material shortage happening and
the impact it could have on production. They also consider the possibility of
technical failures and how that might affect their ability to meet production
targets.
◦ Documentation:
◦ The identified risks are documented. For instance, they note down the risk of a
shortage in the supply of sugar cane and the risk of technical glitches in their
machinery.
©Prepared by Muhammad Waqas Chughtai
◦ Analyzing Controls:
◦ The company looks at their current processes. They find that they have
multiple suppliers for sugar cane, reducing the risk of a shortage. They also
have maintenance schedules in place for their machinery to minimize
technical failures.
◦ Recommendations:
◦ Despite the existing controls, they realize that depending on multiple
suppliers might have its challenges. They recommend exploring long-term
contracts with reliable suppliers to ensure a stable supply of raw materials.
◦ Implementation:
◦ The company decides to implement the recommendation by negotiating
long-term contracts with key suppliers. They also enhance their machinery
maintenance procedures to further reduce the risk of technical failures.
©Prepared by Muhammad Waqas Chughtai
◦ Monitoring:
◦ Regularly, the company monitors the supply chain and machinery
performance. They keep an eye on market trends and potential changes
that could affect the supply of sugar cane.
◦ Reporting:
◦ The findings of the risk audit, the implemented changes, and the ongoing
monitoring results are communicated to company management and
relevant stakeholders. This ensures everyone is aware of the steps taken to
manage risks and maintain smooth production.

©Prepared by Muhammad Waqas Chughtai

6. Financial Risk Managemet

©Prepared by Muhammad Waqas Chughtai

6.1 What is Financial Risk?
◦ Individuals and corporations face various financial risks. In general, financial
risks are events or occurrences with undesirable or unpredictable financial
outcomes or impacts.
Individual Financial Risks
◦ Employment/Income Risk: The risk that you might lose your job or your
income could go down.
◦ Expense Risk: The risk that your everyday costs might go up unexpectedly.
◦ Asset/Investment Risk: The risk that the things you own or invest in (like
stocks or property) might lose value.
◦ Credit/Debt Risk: The risk that you might have trouble paying back money you
owe.

©Prepared by Muhammad Waqas Chughtai

Cont. What is Financial Risk?
Companies Financial Risks
◦ Market Risk: The risk that changes in the economy or the market might affect
the company's value.
◦ Credit Risk: The risk that customers or other companies might not pay back
the money they owe.
◦ Liquidity Risk: The risk that a company might not have enough quick-to-sell
assets to cover its immediate expenses.
◦ Operational Risk: The risk that something could go wrong with how the
company operates, like a technical glitch or a problem with employees.

©Prepared by Muhammad Waqas Chughtai

6.2 Financial Risk Management
◦ The financial risk management process involves a systematic approach to
identifying, assessing, and managing risks related to a company's financial
activities.
◦ The goal is to protect the organization from potential adverse financial outcomes
and to ensure the achievement of its financial objectives.
◦ Financial Risks Management Process
1. Identifying the Risk:
◦ In this step, the focus is on recognizing and understanding the various financial
risks that the organization may face. Financial risks can include market risk, credit
risk, liquidity risk, operational risk, and more.
◦ Examples of risks could include interest rate fluctuations, currency exchange rate
risks, credit defaults, and commodity price volatility.
©Prepared by Muhammad Waqas Chughtai
Cont. Financial Risk Management
2. Assessing and Quantifying the Risk:
◦ Once risks are identified, the next step is to assess and quantify them. This involves
evaluating the potential impact of each risk on the organization's financial
performance and determining the likelihood of occurrence.
◦ Quantitative methods, such as statistical models and financial analysis, may be
employed to assign numerical values to the identified risks.
3. Defining Strategies to Manage the Risk:
◦ After assessing the risks, the organization needs to develop strategies to manage
or mitigate them. The chosen strategies should align with the company's risk
appetite and overall financial goals.
◦ Strategies can include risk avoidance, risk reduction, risk transfer (e.g., through
insurance or hedging), and risk acceptance, depending on the nature and severity
of the risks.

©Prepared by Muhammad Waqas Chughtai

Cont. Financial Risk Management
4. Implementing a Strategy to Manage the Risk:
◦ With defined risk management strategies, the organization puts them into action.
This may involve implementing financial instruments like derivatives, establishing
hedging programs, diversifying investments, or negotiating contractual terms to
transfer risk.
◦ Effective communication and coordination are crucial during this stage to ensure
that the risk management measures are executed as planned.
5. Monitoring the Effectiveness of the Strategy in Managing the Risk:
◦ The final step involves ongoing monitoring and evaluation of the implemented risk
management strategies. This ensures that the strategies remain effective in the
face of changing market conditions, business operations, or external factors.
◦ Regular reviews help identify any new or emerging risks and allow for adjustments
to the risk management strategies as needed.

©Prepared by Muhammad Waqas Chughtai

7. Risk Management of a Limited
Company

©Prepared by Muhammad Waqas Chughtai

7.1 Risk Management of a Limited Co.
◦
A risk management system for a limited company involves identifying,
assessing, and mitigating risks that could impact the company's objectives and
operations.
◦ The goal is to minimize potential negative impacts and capitalize on
opportunities.
◦ Framework of Risk Management System o Audit
1. Risk Identification:
◦ Internal Risks: Identify risks within the company, such as operational,
financial, human resources, and strategic risks.
◦ External Risks: Consider external factors like economic conditions,
regulatory changes, market competition, and geopolitical events.
©Prepared by Muhammad Waqas Chughtai
Cont. Risk Management of a Limited Co.
2. Risk Assessment:
◦ Quantitative Assessment: Use data and metrics to assess risks
numerically, such as financial losses, market volatility, or project delays.
◦ Qualitative Assessment: Evaluate non-quantifiable risks using qualitative
factors, like the impact on reputation, regulatory compliance, or
customer satisfaction.
3. Risk Prioritization:
◦ Prioritize risks based on their potential impact and likelihood of
occurrence.
◦ Classify risks into high, medium, and low categories to focus resources
on the most critical areas.

©Prepared by Muhammad Waqas Chughtai

Cont. Risk Management of a Limited Co.
4. Risk Mitigation and Control:
◦ Risk Transfer (Sharing): Transfer some risks through insurance, outsourcing, or
contractual agreements.
◦ Risk Avoidance: Eliminate or modify activities that pose significant risks.
◦ Risk Reduction: Implement measures to reduce the likelihood or impact of
identified risks.
◦ Risk Acceptance: Acknowledge and accept certain risks when the cost of
mitigation exceeds the potential impact.
5. Monitoring and Review:
◦ Regularly monitor the risk levels and update risk assessments as needed.
◦ Review the effectiveness of risk mitigation strategies and adjust them based on
changing circumstances.

©Prepared by Muhammad Waqas Chughtai

Cont. Risk Management of a Limited Co.
6. Communication and Reporting:
◦ Establish clear communication channels for reporting and discussing risks
throughout the organization.
◦ Provide regular reports to management and stakeholders on the status of
identified risks, mitigation efforts, and changes in the risk landscape.

©Prepared by Muhammad Waqas Chughtai

Thanks

©Prepared by Muhammad Waqas Chughtai