Business Risk Analysis and the Goals of Risk Management

UPI Study › Courses › Quantitative Analysis › Free lessons › Lesson 2.4 Free with a free account

Business Risk Analysis and the Goals of Risk Management

Quantitative Analysis · Chapter 2: Decision-Making Models and RiskSection 2.4 · lesson 8 of 5511 min · free with a free account

← Decision-Making Under UncertaintyNext lesson: Simulation for Business Problem-Solving →

Earn 3 college credits for Quantitative AnalysisRecommended for credit by NCCRS · Math 250 · self-paced · one payment, lifetime access
Enroll in Quantitative Analysis · $250 →Download the syllabus (PDF)

In this lesson

Business risk analysis, and the strategic goals of risk management.

  • Sort exposures into the five categories of business risk
  • Triage with a risk matrix, then rank by likelihood × impact
  • Read a Value-at-Risk statement - and know what it hides
  • Choose avoid, reduce, transfer or accept on cost-benefit grounds

Transcript

Everything said in the video, section by section (1,525 words). Read along, or search it.

QAN-201 - Quantitative Analysis · Section 2.4

Knowing What Could Go Wrong

Risk management has a reputation problem. Most people assume the job is to stop bad things from happening. It is not. The job is to understand risk, to price it, and to control it. Here is the tension that turns that into a discipline. A firm that takes no risk earns no return at all. A firm that takes uncontrolled risk eventually fails outright. Everything in this section lives on the path between those two failures. We map the five categories of business risk first. Then we measure them, with a matrix, with scoring, and with Value at Risk. Then we decide what to do, on strict cost and benefit grounds.

The Premise

Not Elimination - Control

Start with what risk management is not. It is not the elimination of uncertainty. Every business decision involves uncertainty about outcomes, and that never goes away. The manager's role is to make uncertainty visible, measurable, and manageable. Take those three words in order, because the order is the method. Visible first, because a risk nobody has named cannot be measured. Measurable second, because a risk you cannot compare cannot be ranked. Manageable last, because a response only makes sense once you know the size. Then there are two ways a firm gets this wrong. Take no risk, and you earn no return. That failure is slow. Take uncontrolled risk, and you fail outright. That one is fast. This discipline is the structured pursuit of the middle path between them.

The Landscape

Five Categories of Business Risk

Business risks are conventionally grouped into five broad categories. Strategic, operational, financial, compliance and legal, and market. Picture them radiating outward from the core of the enterprise. The categories are not airtight, and it is worth saying that plainly. Take a data breach. It is operational, because a system or a process failed. It is a compliance matter, because privacy regulators will want an answer. It is financial, because remediation and fines cost real money. And it is reputational, because customers read the news. One incident, four categories at once. So do not treat the list as a filing system for tidy incidents. Treat it as a checklist, whose only job is to ensure nothing gets overlooked.

In Detail

What Each Category Threatens

Each category threatens something different, and that is the useful part. Strategic risk threatens the long-term viability of the business model itself. A new competitor, a technology shift, a regulatory upheaval, changing consumer preferences. Operational risk threatens the day-to-day continuity of processes, systems, and people. Think of an IT outage, a supply chain breakdown, employee error or fraud. Financial risk threatens the balance sheet and cash flows: interest rates, foreign exchange, credit defaults. Compliance and legal risk threatens legal standing and public reputation. Market risk threatens revenue stability in the face of external market forces. Now notice the hierarchy inside that list. Strategic risks decide whether the business survives at all. Operational and market risks decide how well it performs in the meantime. Both deserve attention. But the horizons differ, and so do the people responsible.

Visual Triage

The Risk Matrix

Identification is the easy half. Once you have a list, those risks must be compared. And comparison requires measurement. The risk matrix is the most widely used qualitative tool in the field. Every identified risk is placed on a two-dimensional grid. One axis is the estimated likelihood that the risk occurs. The other is the impact it would have if it did occur. The grid is colour-coded, and the colour carries the decision. Risks in the upper-right zone demand immediate action. Risks in the lower-left can be accepted, with light monitoring. The strength here is speed. It triages a long list on judgement alone. The limit is that judgement never produces a number you can put in a budget.

Scoring

Probability × Impact

To move from a picture to a ranking, you need arithmetic. Assign each risk a probability score, and an impact score. Typically each of them sits on a one to five scale. Then multiply the two together. That product is the risk score. Scores run from one, which is trivial, up to twenty-five, which is catastrophic. Most organizations then set policy thresholds along that scale. For example, any risk scoring fifteen or above must be escalated. Escalated to the executive risk committee, within forty-eight hours. Count the grid, and only six of the twenty-five cells reach fifteen. That gate is deliberately narrow, and it is meant to be. But be careful with multiplication. Likelihood five with impact three gives fifteen. So does likelihood three with impact five. Same number, very different risk. Read the pair, never just the product.

Worked Example

A Triage Table

Here is that scoring applied to four candidates. A single supplier port closure. Likelihood four, impact five. Four times five is twenty. Extreme, so it escalates. A payroll system outage lasting one day. Likelihood three, impact three. Three times three is nine. High, so it is actively managed. A minor data entry error. Likelihood four, impact one. Four times one is four. Moderate, so monitor it. The office coffee machine breaks. Likelihood two, impact one. Two times one is two. Low, and simply accepted. Now compare two of those rows. The data entry error is more likely, four against three. Yet it scores four against nine, because impact is where the money is. That is the correction the arithmetic makes to your intuition.

Quantifying

Value-at-Risk

The third tool is properly quantitative, and finance uses it widely. Value at Risk answers one specific question, and only that question. What is the maximum loss I can expect on this position? Over a specified time horizon, and at a given confidence level. Here is what that sounds like in practice. The one day, ninety-five percent Value at Risk of our trading book is two point three million dollars. Unpack it. On a normal trading day, there is a ninety-five percent chance. A ninety-five percent chance that losses will not exceed that figure. Now invert the same claim, because the inverted form is the useful one. On roughly one day in every twenty, losses are expected to exceed it. Three numbers make that statement mean anything. A horizon, a confidence level, and a loss threshold. Drop one and it says nothing.

The Caveat

What VaR Does Not Tell You

Now the caveat, and it is the most important idea in this section. Value at Risk tells you the threshold of tail losses. It tells you nothing about how bad losses get beyond that threshold. Two trading books can report the same number and meet completely different fates. The two thousand and eight financial crisis exposed exactly this weakness. It exposed firms that managed to Value at Risk, and ignored the five percent tail. Modern frameworks therefore supplement the measure in two ways. Expected Shortfall reports the average loss inside the tail. Not the point where the tail begins, but what happens once you are in it. Stress testing runs the book against specific named scenarios instead. A summary number is a summary. It is not a plan.

Responses

Four Ways to Answer a Risk

A risk that has been identified, assessed and prioritised still needs a decision. Four canonical responses are available. Avoid means eliminating the activity that generates the risk altogether. That fits when the risk is unacceptable and the activity is not essential to strategy. Reduce means internal controls, redundancy, process improvements, or training. You reduce when the activity is valuable and the risk is controllable at reasonable cost. Transfer shifts the financial consequence to a third party: insurance, hedging, or outsourcing. Transfer works when a counterparty will take the risk for a premium below your expected loss. Accept means consciously retaining the risk, reserving for it, and monitoring it. That is right when mitigation costs more than the expected loss itself. Most real programs use all four at once. Different responses, for different risks.

The Test

The Cost-Benefit Principle

Which response you choose is not a matter of temperament. There is a principle, and it cuts in both directions. Never spend more on mitigating a risk than the expected value of the loss it could cause. Take over-spending first. You spend one million dollars against a risk whose expected annual cost is fifty thousand. That is twenty times the expected annual loss. You have not protected value there. You have quietly destroyed it. Now the mirror image of the same mistake. You ignore a one million dollar risk to save fifty thousand dollars in controls. Value is destroyed just as surely, only later, and far more loudly. Both errors look like prudence from the inside. That is what makes them dangerous. Which is exactly why this trade-off has to be made with numbers.

The Goals

What Risk Management Is For

Step back from the individual tools for a moment. What is the risk management function actually for? Four goals appear in nearly every corporate risk framework. First, protect the going concern. Ensure the organization survives events that would otherwise threaten its existence. Second, stabilise earnings and cash flows. Lower volatility lets investors, lenders and operating managers plan with confidence. Third, inform decision-making, with an explicit risk-adjusted view of every major choice. So that trade-offs get made consciously, rather than by default. Fourth, allocate capital efficiently, toward returns that justify the risk taken. And away from activities whose risk simply swallows the return. Notice that not one of those four goals is to eliminate risk.

About Quantitative Analysis at UPI Study

Quantitative Analysis (Math 250) is a self-paced online course of 55 video lessons in 13 chapters, from decision analysis and simulation to inventory and queuing models, project scheduling, linear programming and transportation models. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Math courses Every course with PRO →

Compare: Statistics vs Quantitative Analysis

Why take it here

Why students take Quantitative Analysis with UPI Study

Decide with numbersQuantitative Analysis teaches the models managers use to decide under uncertainty: decision trees, simulation, inventory and queuing models, project scheduling and linear programming. It is part of many business, management, operations and supply-chain programs.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Quantitative Analysis carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Business Risk Analysis and the Goals of Risk Management

What are the five main categories of business risk?
Business risks are commonly grouped as strategic, operational, financial, compliance and legal, and market risk. Strategic risk threatens the business model itself, operational risk threatens daily processes and systems, financial risk hits cash flows and the balance sheet, compliance and legal risk threatens legal standing and reputation, and market risk threatens revenue stability. One event, like a data breach, can fall into several categories at once.
How do you calculate a risk score using likelihood and impact?
A risk score is the likelihood score multiplied by the impact score, each usually rated from 1 to 5, giving results from 1 to 25. A supplier port closure rated likelihood 4 and impact 5 scores 20 and would be escalated, while a minor data entry error at 4 and 1 scores only 4. Always read the pair, since 5 × 3 and 3 × 5 both give 15 yet describe very different risks.
What does Value at Risk (VaR) tell you, and what does it miss?
Value at Risk states the loss that should not be exceeded over a given horizon at a given confidence level. A one-day 95% VaR of $2.3 million means losses should exceed that amount on roughly one day in twenty. VaR says nothing about how large losses get beyond that threshold, a weakness exposed in 2008, so firms add Expected Shortfall, the average loss in the tail, and stress testing.
What are the four ways to respond to a business risk?
The four responses are avoid, reduce, transfer and accept. Avoid eliminates the activity causing the risk, reduce uses controls, redundancy or training, transfer shifts the financial consequence through insurance, hedging or outsourcing, and accept consciously retains and monitors it. The choice follows cost-benefit logic: spending $1 million to mitigate a risk with a $50,000 expected annual cost destroys value, as does ignoring a large risk to save on controls.

About the Quantitative Analysis course

How many college credits is Quantitative Analysis?
Quantitative Analysis (Math 250) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Quantitative Analysis cost and what is included?
$250, paid once, with lifetime access: all 55 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Quantitative Analysis take?
It is self-paced with no deadlines. The 55 lessons total about 11 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Quantitative Analysis.

55 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Quantitative Analysis →Download the syllabusEvery course with PRO →
Quantitative Analysis
3 credits · NCCRSEnroll →