Charity Accountants Conference

1
Charity Accountants Conference

• Risk assessment
• Annabel Elliott
• 17 September 2009

2
Structure

• Risk
• 4 Steps
• Case study
• Questions

3
Misconceptions Risk management is not

• Confined to finance and IT departments
• Avoiding all risk
• A pure form filling exercise
• An exercise performed periodically and
  independently of strategy and day to day
  operations

4
Risk management is

• A positive approach to assist in the
  implementation of strategy
• A mechanism to share common understanding of risk
  within the organisation
• A way of recognising existing controls and
  identifying control gaps
• A framework to make the most of opportunities and
  take risks with your eyes open

5
Definition of risk

• A chance or possibility of danger, loss, injury,
  or other adverse consequences

6
Definition of risk

• Uncertainties surrounding opportunities and
  threats which have the potential to enhance or
  inhibit
• performance
• achievement of objectives
• meeting stakeholder expectations

7
Step 1 - Identify risks

• Think about
• What risks does the organisation run because of
  its work?
• What would prevent the organisation from
  achieving its objectives?

8
Articulating risk

• Words you might expect to use to describe a risk

• Failure to .
• Loss of
• Lack of .
• Reliance on
• Increase in

9
Types of risk

• People
• Financial
• Funding
• Competition
• Management
• Information

• Property
• Regulatory
• Governance
• Technology
• Political
• Natural

10
Step 2 Rank risks

• Key factors are
• Likelihood
• Impact

11
Choose a ranking system e.g.

• Likelihood
• 1 very unlikely
• 2 unlikely
• 3 possible
• 4 likely
• 5 highly likely

• Impact
• 1 insignificant
• 2 significant
• 3 serious
• 4 very serious
• 5 major disaster

12
Scoring and prioritising risks
13
Step 3 controls in place

• What are the controls already in place?
• How effective are the controls?
• Include a wide range of management controls, not
  just financial procedures

14
What is a control?

• Most agree that control is based around three
  key concepts.
• It is a process that runs throughout the
  organisation
• It is based around people and how they behave at
  work
• It can only provide reasonable not absolute
  assurance that objectives will be achieved.
• (Source KH Spencer Pickett, Internal Control A
  managers journey)

15
Step 4 responses
mitigate effects
avoid/minimise likelihood
accept/tolerate
minimise likelihood/accept
16
Risk register

• For high priorities
• Clear identification of the risk
• Consequences of that risk becoming a reality
• Action - who responsible and timescale
• Monitoring

17
Example risk register
18
Common mistakes/errors in risk processes

• Too many risks identified cant see wood for
  trees
• Trustees get bogged down in operational risk
• Lack of ownership

19
Case study

• Likelihood
• 1 very unlikely
• 2 unlikely
• 3 possible
• 4 likely
• 5 highly likely

• Impact
• 1 insignificant
• 2 significant
• 3 serious
• 4 very serious
• 5 major disaster

20
Summary

• Make it part of routine business planning
  activities
• Ensure responsibility is appropriately assigned
• Review it regularly right level of detail to
  right audience
• Integrate required actions into performance
  management for individuals and monitoring
  against plan for organisation as a whole

21
Contact

• Annabel Elliott
• 020 7841 6360
• annabel_at_sayervincent.co.uk
• Resources
• Risk assessment made simple