CHAPTER 2

TYPES AND SOURCES OF

RISKS
Learning Outcomes

■ At the end of this chapter, students should be able to

1. Understand the sources of risks
2. Explain the risks facing by organisation
3. Understand the risk exposure for the organisation
4. Identify possible type of specific risks associated with the organisation
❑ THE AIM OF RISK IDENTIFICATION IS TO IDENTIFY POSSIBLE RISKS
THAT MAY AFFECT, EITHER NEGATIVELY OR POSITIVELY, THE
OBJECTIVES OF THE BUSINESS AND THE ACTIVITY UNDER
ANALYSIS.
RISK IDENTIFICATION CAN BE DONE BY EVALUATING THE
FOLLOWING QUESTIONS
 There are two main ways to identify
risk:
■ Identifying retrospective risks
Retrospective risks are those that have previously occurred, such as incidents or
accidents. Retrospective risk identification is often the most common way to identify risk,
and the easiest. It’s easier to believe something if it has happened before. It is also easier
to quantify its impact and to see the damage it has caused.
■ There are many sources of information about retrospective risk. These include:
• Hazard or incident logs or registers
• Audit reports
• Customer complaints
• Accreditation documents and reports
• Past staff or client surveys
• Newspapers or professional media, such as journals or websites.
Identifying prospective risks
■ Prospective risks are often harder to identify. These are things that have not
yet happened but might happen some time in the future.
■ Identification should include all risks, whether they are currently being
managed. The rationale here is to record all significant risks and monitor or
review the effectiveness of their control.
■ Methods for identifying prospective risks include:
• Brainstorming with staff or external stakeholders
• Researching the economic, political, legislative and operating environment
• Conducting interviews with relevant people and/or organizations
• Undertaking surveys of staff or clients to identify anticipated issues or
problems
• Flowcharting a process
• Reviewing system design or preparing system analysis techniques.
 RISKS CATEGORISATION
Strategic risks
Arise from long term effects such as those relating to
the nature and type of business, changes in competitive Operational risks
and legal environments, poor long-term decisions being Short-term, day-to-day problems. For example, a
made. For example, a supermarket which did not machine breaking down, a key employee leaving, a fire
respond to the growing popularity of online shopping breaking out in the warehouse or a fraud occurring.
would have opened itself to a long-term decline in
profits.

There are many ways in which

risks can be categorised. One
categorisation is strategic,
operational, reporting and
compliance risks:

Reporting risks Compliance risks

Risks arising because internal and external reporting The risks arising from not complying with rules and
are not reliable. For example, management accounts regulations. Penalties, loss or reputation and removal of
containing errors can lead to incorrect analysis and operating licenses can all result.
decisions.
 TYPES OF RISK ANALYSIS
■ Three types of analysis can be used to determine level of risk:
• Qualitative
• Semi-quantitative
• Quantitative
▪ The most common type of risk analysis is the qualitative method. The type of
analysis chosen will be based upon the area of risk being analyzed
▪ Identification of risks can be done by management based on the risk
appetite of the organisation
SYSTEMATIC and UNSYSTEMATIC
RISKS
SYSTEMATIC
RISKS
UNSYSTEMATIC
RISKS
 TYPES OF
RISKS IN
ORGANISATION
EMPLOYEES MALFEASANCE RISK
CYBER RISK
 Political, Legal and Regulatory Risk
■ These are the risks that businesses face because of the regulatory
environment they are currently operating. Some businesses might face
strict regulatory requirement such as environmental regulation and safety
requirement. On top of that, the company might need to comply with
regulatory and legal requirement to avoid litigation with stakeholders such
as government, supplier and consumers.
■ There are 4 classification namely;
⮚Political risk – Risk due to political instability. Generally considered as an
external risk to the business.
⮚Legal/litigation risk – Risk that legal action will be brought against the
business
⮚Regulatory risk – Risk of changes in regulation affecting the business
⮚Compliance risk – Risk of non-compliance with the law resulting in fines and
penalty
 ■ Depends on the large extent on the
political stability and the political

Political
institutions in the country or countries in
which an organization operates. A
change of government sometimes

risk result in dramatic changes for

businesses.
■ In an extreme case, for example, an
incoming government might nationalize
all foreign businesses operating in the
suggested reading materials country. Even in countries with a stable
http://www.iberglobal.com/fil political system, political change can be
es/2016-2/managing- significant.
political-risk.pdf ■ For example, an incoming new
government might revamp the existing
policy or introducing new policy for the
business
 ■ Regulatory risk is the risk arises from
the possibility that regulations will affect
the way an organization has to operate.
Regulations might apply to businesses

Regulatory
generally or to specific industry
■ For example, competition law, fair trade
law or anti-monopoly regulations

Risk and ■ Compliance risk is the risk of losses,

possibly fines, resulting from non-

Compliance ■
compliance with laws and regulations.
Measures to ensure compliance with

Risk
rules and regulations should be an
integral part of an organization’s internal
control system
■ For example, risk of being sued due to
pollution and safety hazard
 ■ Litigation or legal risk arises from the
possibility of legal action being taken
against organization. For many
organisations, the risk can be high.
■ The organization might face risks of
negligence, risk of compliance or risk of
being sued by third party

Legal risk
■ For example, hospital and hospital
workers might be exposed to risks of
legal action for negligence. Tobacco
companies have been exposed to legal
action for compensation from cancer
victims.
■ Companies manufacturing or providing
food and drink might need to aware on
the potential risk of litigation from
customers claiming that a product has
damaged their health condition
 ■ Business risk is the risk businesses face due to the nature of
their operations and products. Small scale business might face
major disruption if any of business risk occur in their
organization.
■ Business risks can be categorized into:
❖ Strategic risk (risk that business strategies will fail –
launching of new product/company acquisition)
❖ Product risk (risk of a failure of new product launches/loss of

Business
interest in existing products)
❖ Commodity price risk (risk of a rise in commodity prices –
increase of price in palm oil)

Risk ❖ Product reputation risk (risk of change in product’s

reputation or image – product is associated with bad publicity
❖ Operational risk (risk that business operations might be
inefficient or failure in business process – Unavailability of raw
materials/scarce number of raw materials)
❖ Contractual inadequacy risk (risk that the terms of a contract
do not fully cover a business against all potential outcomes
 ■ Risks arising from the possible consequences of
strategic decisions taken by the organization
■ Strategic risks should be identified and assessed
at senior management and board of director
level
■ This risk is very important as it might affect the
business or organisations mission and vision in
the long term

Strategic ■ For example, two companies that are currently

looking for strategy growth might use strategy

Risks
such as by acquisition or organic growth. Growth
by acquisition tend to be riskier due to the
involvement of other parties and might give
impact to the business mission and vision.
■ On top of that, current condition of covid-19 has
resulted into reshaping nature of working by
most business (Work from Home). The adoption
of WFH with a proper mechanism will helps
business to sustain their mission and adding
value to their business
 Product risk is the risk that customers will not
buy the product or use the services provided by
the business and might affect demand level for
the existing product or services

A new product launched on the market might fail

to achieve the expected volume of sales or the
projection of customer purchase might not be
Product met

Risk Risk that associated with the product is a major

risk in most business. The management will
conduct market study and feasibility study to
minimize the impact of product risks

For example, the demand for ‘three generation’

(3G) mobile communication services is much
slower than expected due to lack of
infrastructure and mobile device that can cater
the 3G requirement (speed)
Commodity Price Risk

Business that heavily rely on

Businesses might be
commodity such as oil
exposed to risks from This will result to the increase
company, food supplier are
unexpected increases (or in price by the supplier to the
normally affected by the
falls) in the price of key users
fluctuation of price in
commodity
commodity

A food and beverages

industry that impacted by the
For example, an airlines that increase of commodity price
face increase of price in oil (palm oil) might need to
might adjust their ticket price increase the price of their
charged to the customer product or adjust their
business strategy (reduce
quantity, smaller packaging)
Product Reputation Risk

Some companies rely heavily

on brand image and product Risk to a product’s reputation There could be a risk from
reputation. Thus, bad could arise from adverse changes in customer
publicity and adverse event public attitudes to a product perceptions about the quality
might highly impact their or from adverse publicity of the product
sales in the market

For example, if a car

manufacturer announces that In Malaysia, there is an event
If product reputation risk is it is recalling all new models that highly impact product
not address properly, it might of a car to rectify a design reputation such as non-halal
shift customer loyalty to the defect (air bag, seat belt ingredient use in Gardenia
business competitors specifications) the product (bakery); funding of terrorist
reputation and its future organization (McDonald)
sales might be affected
 ■ This risk refers to potential losses that might
arise in business operations. It has been defined
broadly as ‘the risk of losses resulting from
inadequate or failed internal processes, people
and systems or external events that can disrupt

Operational
the flow of business operation
■ The risk can directly or indirectly impact the
financial situation in the organisation

Risk ■ Operational risks include risks of fraud or

employee malfeasance and failure in internal
control system
An insight
Operational risks is the fundamental elements in
https://www.youtube.com/ ■
business environment; therefore, assessment of
watch?v=09EXWG1BWNg this risk must be done properly
■ For example, business around the world has face
major interruption during pandemic covid-19
with the regulation and mandatory restriction on
movement. Most businesses unable to continue
their operation and result in higher
overhead/operational cost to pay idle labour
 Contractual inadequacy risk

This risk might arise This risk can be mitigated The company can include For example, a building In this case, if the
when the business has by having terms and the right that it can claim company may have a business did not consider
negotiated contracts and condition stated in the if unfavorable fixed completion date for this type of risks before
business transactions contract before the circumstances arise the construction of a agreeing to build the
without adequate transaction or contract is (other party did not honor house. If it is not house, there might be
consideration of what signed by both parties the contract) completed on time, they quantifiable (loss of
may happen if things may have to pay money) and
does not go according to compensation to the unquantifiable
the existing plan buyer. Similarly, the buyer (reputation risk) of loss
might not have sufficient
fund to pay for the
instalment when the
payment is due
 1. Which of the following would normally be
classified as an operational risk?
Select ALL that apply
A. The risk that a new product will fail
B. The risk of competitors cutting costs by
outsourcing their manufacturing processes to

Test Your
low-cost labour country
C. The loss of an experienced supervisor

Knowledge
D. Raw materials being wasted during the
production process due to untrained staff
2. Which of the following would normally be
classified as a strategic risk?
A. Human error
B. Information technology failure
C. Fraud
D. Stricter health and safety legislation
Economic risk

These changes in economic landscape

might resulted from inflation,
Risk that resulted from changes in This risk is external risk for the business
unemployment rates, international trade
overall business condition which is uncontrollable
relations or any changes in fiscal policy
decisions by the government

Example of this risk is changes in

population in the country (citizen are
migrating to other country)– resulted in Government might impose control on
changes on target market population or price mechanism such as price ceiling
high inflation rate due to economic and price floor which might impact
instability (the purchasing power parity; business profitability in the long run
whether customer can afford to buy the
product sold in the market)
CASE STUDY – The “credit crunch”
2008 – An US Subprime Mortgage
Crisis
■ The case study is an extract from P3-CIMA Strategic Paper
■ This case study can be use for discussion in the class
■ Materials is available at https://docs.google.com/presentation/d/1-
XJNZEPsLefATCaxdvAEn7Bo9zfKMXmQ/edit?usp=sharing&ouid=104347
977760814681404&rtpof=true&sd=true
 ■ Financial risk is a risk of a change in a financial
condition such as exchange rate, interest rate,
credit rating of a customer or changes in price of
goods
■ This risk is related to the possibility of changes in
financial conditions and circumstances
■ There are 5 main types of financial risk.

Financial ❖

❖
Credit risk – Risk of non-payment by
customer/default payment by customer
Political risk – Risk associated with the

Risk actions taken by policy maker that might

affect the financial aspects of the business
(changes in fiscal policy, introduction of
new policy that related to financial aspect)
❖ Currency risk – Risk of fluctuations in the
exchange rate
❖ Interest rate risk – Risk of changes in
interest rate
❖ Gearing risk – Risk of the business funding
(how business is financed – debt vs equity)
 ■ Credit risk is the possibility of losses due to non-
payment by debtors. The possibility that a loss may
occur from the failure of another party to perform
according to the terms of a contract. One form of credit
risk is debt leverage risk: the larger a debt becomes as a
portion of an entity’s capital structure; the risk of default
of interest payments and repayment of the principal
becomes greater.

■ The business can mitigate credit risk by conducting

preliminary assessment to the potential
debtors/customer

Credit Risk ■

1.
The exposure of a company to credit risks depends on
various factors such as:

The total volume of credit sales

2. The organization’s credit policy

3. Credit terms offered (credit limits for individual

customers and the duration of payment)

4. The credit risk ‘quality’ of customers: some types of

customer are a greater risk than others

5. Credit vetting and assessment procedures

6. Debt collection procedures

 ■ Currency risk or foreign exchange risk,
arises from the possibility of movement
in foreign exchange rates, and the value
of one currency in relation to another

Currency ■ In currency risk, there is a risk that the

value of a financial instrument will

risk fluctuate due to changes in foreign

exchange rates (IAS 32).
■ There are two sub-categories of
currency risk:
⮚ Translation or currency conversion
https://www.youtube.c exposure: susceptibility of the financial
om/watch?v=_8DgWU statements to the effect of foreign
exchange rate changes
xFd84
⮚ Currency transaction exposure:
susceptibility of an entity to the effect of
foreign exchange rate changes during
the transaction cycle associated with
the export/import of goods or services
 ■ Risk that interest rate changes will affect the
financial well-being of an entity. This includes
changes in interest rates adversely affecting the
value and liquidity of fixed or floating rate
exposures. In addition to bond prices, interest
rate fluctuations also directly affect stock prices,
foreign exchange rates and economic growth
■ Interest rate risk is the risk of unexpected gains
or losses arising because of a rise or fall in

Interest
interest rates
■ Exposure of interest rate might arise from
borrowing and investing (to earn interest) or

rate risk ■
depositing cash
For example, a company is expecting to borrow
$5 million for six months and wishes to hedge
itself against a rise in short term interest rates
■ The company can either enter into a forward
rate contract (these are usually for at least $1m)
or an interest rate futures contract (called a
‘short’) to hedge against a rise in interest rate
over the next six months. These type of
derivative products are best suited to short term
exposures
 ■ Gearing risk also known as liquidity risk is
the risk arising from exposures to high
financial gearing and large amount of
borrowing
■ Business liquidity related to funding or
cash flow risk; is the risk that an entity will
encounter difficulty in realizing assets or
otherwise raising funds to meet
commitments associated with financial

Gearing risk ■
instruments
One way to mitigate gearing risk is by
evaluating its financial statements. The
business can evaluate its financial
performance over the time and assess any
risk that might contribute to its liquidity
■ For example, business that rely heavily on
debt financing (loan/bond) might have face
bankruptcy if the principal or interest
payment obligation could not be made on
time
References and Answer
■ Test your knowledge
1. C and D (A and B are strategic risk)
2. D (A, B and C are operational risk)
References
CIMA P3-Case study
CIMA P3-Study notes and materials
https://www.brookings.edu/research/lessons-from-the-financial-crisis-the-central-importance-of-
a-sustainable-affordable-and-inclusive-housing-market/
http://www.iberglobal.com/files/2016-2/managing-political-risk.pdf
https://www.youtube.com/watch?v=09EXWG1BWNg
https://www.youtube.com/watch?v=_8DgWUxFd84
Brooks, R. Beyond the rhetoric. Risk Management, July 2005, Volume 42, Issue 7, pp 37-40
Allen, S. L. (2003). Financial risk management: a practitioner’s guide to managing market and credit
risk. Hoboken, NJ: Wiley