Question

10. What other types of general or specific polices can you describe to manage risks? 11. Why is it that “tone at the top” and a strong risk culture are critical components for a company’s success, such as what you see at JAA?

Chapter 22-Enterprise risk management

Answer 1

10. Risk assessment allows you to evaluate the importance of risks to the company and agree to embrace or take action to prevent or mitigate the specific risk. Such risks need to be rated once you have identified them in order to assess risks. This can be done by taking into account the effect and probability of each threat. Most companies find that determining effect and probability as high, medium or low is appropriate for their needs. This can then be compared with your business plan-to decide which risks can affect your goals-and measured in the light of legal requirements, costs and expectations of stakeholders.

Risk management involves putting in place processes, methods and tools to deal with the consequences of events that you identified as major threats to your business. This could be as simple as setting aside financial reserves to alleviate cash flow issues if they arise or ensuring effective computer backup and IT support procedures to deal with system failure. Business continuity plans are often referred to as projects coping with risks found through risk assessment. These specify what to do if, for example, a certain event occurs when a fire destroys your office.

Managing risk is not a one-off exercise. Continuous monitoring and analysis is key to your risk management approach's performance. Such monitoring ensures that risks have been properly identified and evaluated and that appropriate controls have been put in place. It's also a way to learn from experience and improve your approach to risk management. In a risk management policy, all of this can be formalized, setting out the approach and appetite for risk of your business and its approach to risk management. Risk management will be even more effective if it is clearly assigned to selected employees

12. Tone at the top and a strong risk culture are critical components for the success of a company as it helps to build a good structure while striving to achieve strategic goals. JAA set up an Executive Committee for Risk Oversight, chaired by the CEO. The board believed that this would reflect senior management's corporate commitment to play an active role in day-to-day decision-making. The board also agreed that this would set the tone across the business that risk management was central to corporate culture The new communication channel that was created was another key element that was critical to JAA's success. By implementing this, JAA was seeking to build up the risk culture. This structure helped the company to establish a sound and trustworthy forum for ideas exchange, which reduced confusion. The EROC showed the willingness of executive management to manage risks and helped build a culture of risk understanding and risk within JAA. The successful turnaround in JAA's fortunes is demonstrated by its financial performance achieved by meeting strategic goals