The management of risk is one of the most important issues facing organisations today. High-profile cases such as Barings and Railtrack in the UK, Enron, Adelphia and Worldcom in the USA, and recently Parmalat, demonstrate the consequences of not managing risk properly. For example, organisations which do not fully understand the risks of implementing their strategies are likely to decline. Marconi decided to move into a high-growth area in the telecom sector but failed in two distinct respects. Firstly, growth was by acquisition and Marconi paid premium prices for organisations because of the competitive consolidation within the sector. Secondly, the market values in the telecom sector slumped because the sector was overexposed owing to debt caused by slower growth in sales than expected.

In today’s climate of rapid change people are less likely to recognise the unusual, the decision-making time frame is often smaller, and scarce resources often aggravate the effect of unmanaged risk. The pace of change also means that the risks facing an organisation change constantly (time related). Therefore the management of risk is not a static process but a dynamic process of identification and mitigation that should be regularly reviewed.

All levels of an organisation need to be included in the management of risk in order for it to be effective. These levels are usually termed corporate (policy setting), strategic business (the lines of business) and project. Risk management needs to take into consideration the interaction of these levels and reflect the processes that permit these levels to communicate and learn from each other.

The aim of risk management is therefore threefold. It must identify risk, undertake an objective analysis of risks specific to the organisation, and respond to the risks in an appropriate and effective manner. These stages include being able to assess the prevailing environment (both internal and external) and to assess how any changes to that prevailing environment would impact on a project in hand or on a portfolio of projects.

Figure 1.1 illustrates a typical organisational structure which allows risk management to be focused at different levels. By classifying and categorising risk within these levels it is possible to drill down and roll up to any level of the organisational structure. This should establish which risks a project is most sensitive to so that appropriate risk response strategies may be implemented to benefit all stakeholders.

Figure 1.1 illustrates the corporate, strategic business and project levels which provide the foundation for this book. Risk management is seen to be integral to each level although the flow of information from level to level is not necessarily on a top-down or bottom-up basis. Merna and Merna (2004) believe risks identified at each level are dependent on the information available at the time of the assessment, with each risk being assessed in more detail as more information becomes available. In effect, the impact of risk is time related.

Figure 1.2 illustrates the possible outcomes of risk. The word ‘risk’ is often perceived in a negative way. However, managed in the correct way, prevailing risks can often have a positive impact.

Risk management should consider not only the threats (possible losses) but also the opportunities (possible gains). It is important to note that losses or gains can be made at each level of an organisation.

Typical risks affecting organisations are discussed and risk modelling through computer simulation is explained.

The book also examines portfolio risk management and cash flow management.

Chapter 3 is a general introduction to the topic of risk management. It summarises the history of risk management and provides definitions of risk and uncertainty. It also describes the risk process, in terms of identification, analysis and response. It then goes on to identify the tasks and benefits of risk management, the risk management plan and the typical stakeholders involved in an investment or project.

Chapter 4 is concerned with the tools and techniques used within risk management. It prioritises the techniques into two categories, namely qualitative and quantitative techniques, and describes how such techniques are implemented. It also provides the elements for carrying out a country risk analysis and briefly describes the risks associated with investing in different countries.

Chapter 5 outlines the risks involved in financing projects and the different ways of managing them. The advantages and disadvantages of risk modelling are discussed, and different types of risk software described.

Chapter 6 is concerned with portfolios and the strategies involved in portfolio selection. Bundling projects is examined and cash flows specific to portfolios are analysed. Various methods of cash flow analyses are discussed.

Chapter 7 is specific to the corporate level within an organisation. It is concerned with the history of the corporation, corporate structure, corporate management and the legal obligations of the board of directors, corporate strategy and, primarily, corporate risk.

Chapter 8 is specific to the strategic business level within an organisation. It discusses business formation, and defines the strategic business unit (SBU). It is primarily concerned with strategic management functions, strategic planning and models used within this level. Risks specific to this level are also identified.

Chapter 9 is specific to the project level within an organisation. It outlines the history of project management, its functions, project strategy and risks specific to the project level.

Chapter 10 provides a generic mechanism for the sequence and flow of risk assessment in terms of identification, analysis and response to risk at corporate, strategic business and project levels.

Chapter 11 describes a number of corporate governance codes and how they address the need for risk management.

Chapter 12 introduces the Basel II framework and discusses, in particular, how probability default (PD) and loss given default (LGD) are addressed and other operational management issues.

Chapter 13 describes how quality management can be used to manage many of the risks inherent in organisations and how quality related risks can affect the profitability of an investment.

Chapter 14 provides Case Study 1 which investigates the pharmaceutical industry and illustrates the typical risks in a drug development process (DDP) and how many of these risks can be mitigated.

Chapter 15 provides Case Study 2 which shows the risks associated with the procurement of crude oil and the sale of refined products. This case study also addresses the risks in the supply and offtake contracts and utilises Crystal Ball as the simulation software for modelling and assessment of risks.

Chapter 16 provides Case Study 3 which describes the development of risk registers at corporate, strategic business unit and project levels and the development of a risk statement for a specific project.

The final chapter, Chapter 17, provides Case Study 4 which describes how the major risks at each level of a corporation can be identified and quantitatively analysed and then summarised to develop a risk statement for shareholders.