The risk management process in any business (and in life) consists of the same steps: first identifying risks, then assessing them, trying to mitigate them by developing a plan of action, analysing them and controlling them.
In theory, risk management rests on 'three pillars': utility, regression and diversification. It is necessary to assess not only the probability of a risk occurring, but also its consequences for the company or the investor. Risk management decisions reduce the likelihood of financial loss.
An investor allocates capital by assessing potential returns and risks in advance.
Identifying risksThe most problematic step is finding and identifying potential threats that could affect the business. It is easy to get stuck in this step - it can be very difficult to assess and accept the reality. In business, it's common to consider external influences: economic and political changes, market competition. And internal factors: management system problems, staff and employee issues, changes in products or services.
When analysing the external environment, evaluating internal processes and predicting future events, it is important to consider the risks associated with: major suppliers leaving the market, disagreements between partners, financial uncertainty, legal obligations, technological problems and strategic management errors.
Risk analysisThis stage assesses the likelihood of occurrence and the level of impact on the business of all identified risks - qualitative analysis of likelihood and impact. Collected statistical data is usually used to build qualitative models of possible risks.
Risks are assessed:
- non-financial, not related to the loss of money (operational, legal, reputational, regional, transfer)
- dynamic, whose likelihood and consequences depend mostly on external factors (political, economic, social, environmental and professional)
- static (force majeure, emergency, disaster)