Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: zz-x2580
MS927/MS422 – Risk Analysis &
Management
Office Hours: Usually 3-4 Wednesdays
Co-lecturer:
Tutors:
• Lok Lam; Eddyson Ofem; Akin Awoyinfa-Davies; Saidi
Mustapha
Other Class Teaching Team
Dr Bin Liu
• To developed your ability as an analyst/
decision maker to understand and manage
risk through:
– Equipping you with generic theories and
models that can be used in different contexts.
Class Rationale
Assessment
• Group assignment (50%)
– Critique to business practice in an area of interest &
a modelling business system to manage risk
– Out week 4, due on Tuesday 29th of March
– Peer review
– Deliverables (Presentation + Report)
• Individual online exam (50%), (exam diet, likely
to be at the end of April)
– assess understanding of basic concepts and
techniques
• Blended learning approach using mix of
lectures and computer labs and provided
online notes
Teaching method
• This first session is introductory
• We will introduce different sorts of risk and a standard
risk management approach
• We will look at how companies may deal with risk in
practice
• We will discuss one example of how things can go wrong
- the Soc Gen case – and the lessons that we can learn
from that
• This will provide a framework within which we can
discuss the quantitative tools that we will use in the rest
of the class
Where does today session fit in the
class ?
and Methods.
Reading for today
What is risk?
common thing there is the
uncertainty…
Formal definitions of
risk
• Exposure to) the possibility of loss, injury, or other adverse or
unwelcome circumstance; a chance or situation involving such a
possibility (Oxford English Dictionary),
• Effect of uncertainty on objectives (ISO3100)
• Risk = likelihood of occurrence x severity of outcome
The most popular theory to deal with
uncertainty is the probability theory
Economic System: 2008
Financial Crisis?
• Usually customers go
default independently with
low probability
• The probability of N
customer to fail together is
• However, subprime
mortgages led to a group of
customers to fail
dependently. This led to
cascading effects on the
whole economy
The causality of
uncertain events
• The future is uncertain: we can think of different possible
eventualities linked by causal chains
• We identify an uncertain event within this and consider
the likelihood that this occurs (probability) and the
consequences if it does (costs)
A Causal framework to
understand the Risk
• With the people in the breakrooms online:
discuss and list some of the risks that the
students can face
• Keep the list as we will use it later for risk
matrix (heat map)
Exercise:
Why manage risk?
• Maintain our assets (human, machines,
etc.);
• Avoid losing our market share,
• Avoiding recalling faulty products from the
market,
Why manage risk?
Regulations when it comes to the safety of
people,
Why manage risk?
Farmers Methodology
So, What is risk
management?
A process to understand the level of risk before its
occurrence and have a plan on place to avoid/reduce
the probability of risk to occur and then if the risk occurs,
how deal with its consequences in order to recover.
Trigg
er
Event
After the Risk
Occurs
Deal with the
Consequences, Focus on
Recovery
Before the Risk
Occurs
Focus on Risk Prevention
Use Contingency, or
Recovery Plans
Deal
with the
Cause
1. Perform Risk Assessment
2. Plan Risk Responses
(avoidance, ignore..),
Contingency, and
Recovery Plans
3. Continuous Monitoring
and Revision
Not Linear
Processes
Framework of risk
management
Trigg
er
Event
After the Risk
Occurs
Deal with the
Consequences, Focus on
Recovery
Before the Risk
Occurs
Focus on Risk Prevention
Use Contingency, or
Recovery Plans
Deal
with the
Cause
1. Perform Risk Assessment
2. Plan Risk Responses
(avoidance, ignore..),
Contingency, and
Recovery Plans
3. Continuous Monitoring
and Revision
Not Linear
Processes
Framework of risk
management
Risk Management
ISO31000
◼ Understanding risk:
• What are the risk events and their causes?
• What are the consequences?
◼ Mitigating risk:
• Reduce the probability of a (negative) risk event
• Reduce the negative consequences of a risk event
◼ Sharing risk:
• Can the costs of negative consequences be shifted or spread?
An example is insurance.
Risk management key
components
• Internal Risk (somewhat in our control)
– E.g. employee availability, supply and operations
issues, faulty product
– In these cases we can attempt to reduce or remove
the risk events
• External Risk (outside our control)
– E.g. exchange rates, fuel costs, changes in
regulation, natural catastrophe
– We cannot stop things happening but we can plan
our reactions
Types of risk and mitigation
(Example)
GpeeM
Risk elimination vs management
Based on your experience, do
you think businesses manage
risk in an adequate way?
Toyota supply crisis
• Toyota lost in April 2016
200 million dollars due to
Tsunami hits their
suppliers
• Suppliers are located in
the same place due to
Just-in-Time philosophy
• Does Toyota risk plan
cover such event???
Risk Management in Practice:
what companies usually do
• A risk management plan may be quite formal.
• defines the responsibility for managing and
responding to risks
• allows stakeholders to approve the risk
management approach
• helps to demonstrate that the company has
exercised an appropriate level of diligence if
things do go wrong
Risk management plan
• Many companies set up a risk register giving a single
point where information is gathered together
• Encourages a careful assessment of risk and likely
responses to risk events
• The risk register indicates for each risk identified
• Its causes and impacts
•The existing controls
•An assessment of the consequences
•A likelihood
• Management can then determine a risk treatment plan
to reduce the level of risk
Risk Register
“Heat map” to assess the
risk
Very likely
Likely
Moderate
Unlikely
Rare
L
LL
L
L
H H
H
H
H
HH
H
E E
E
E
E
E
E
EM
M
M
M
Magnitude of Impact
Example
Schiphol Group (2013)
• Can you classify the listed risks from
exercise 1 using the heat map?
Exercise 2
• Need to have a common understanding of what probabilities are
associated with words like ‘likely’ or ‘unlikely’
• Need to have a common reference for the time period considered: a
10% chance in a year becomes a 65% chance over a period of 10
years
• Need to have a common understanding of what is meant by e.g. a
‘moderate’ impact. Can this be put into monetary terms?
• The designations (E,H,M,L) are partly random. For example we
could rate a very likely risk with moderate impact as ‘High’ rather
than ‘Extreme’.
Problems with heat maps?
Subjectivity and lack of common
understanding
• PRA is a scenario-based methodology that tries
to quantify the risks of (human) activities in
terms of probability and consequences
• Tries to answer the questions:
– (i) What can happen?
– (ii) what is the probability of it to happen?
– (iii) Given that it occurs, what are the consequences?
Probabilistic Risk
Assessment (class focus)
• To support the tools and
techniques for management
decision making,
• To validate claims for risk
and to demonstrate the
need for improvement,
• Most importantly PRA is a
way to have a standard
language to communicate
the risk
PRA is used -
What Can go wrong? Soc Gen
case (think 10 minutes and
then write a very short blog to
myplace)
Common risk management traps
Case: Soc Gen fraud
• In January 2008 Société Générale (one of the largest
banks in Europe) revealed that a rogue employee
had executed a series of "elaborate, fictitious
transactions" that cost the company €4.9 billion.
• Jérôme Kerviel joined Soc Gen in 2000, worked for
several years in the risk‐management office (the
“middle office”) before moving to a trading desk in
Paris.
Case: Soc Gen fraud
• Kerviel placed huge real purchases in one portfolio and
created fictitious sales transactions in a second, offsetting
portfolio, so that risks in the first portfolio appeared to be
hedged, when in fact they were not
• When the fraud was uncovered the enormous position that
he had built needed to be closed out as quickly as possible.
Soc Gen was forced to unwind the trades at the same time as
global stock markets plunged
What went wrong?
• Kerviel kept risk management access even when he became a
trader
• Most of the time he was making profits for Soc Gen. This
happened while there was a big expansion in trading activity at
Soc Gen
• His superior left and when eventually replaced the new superior
did not track what was going on:
– a huge jump in earnings in 2007; questions about his trades
from the Eurex exchange; unusually high levels of cash flow; his
failure to take any annual leave; a breach of the desk's market
risk limit on one position
• Company culture is more important than procedures. It often gives
precedence to the money making side of the business (trading)
over the risk management side (middle office)
• Good times breed risky behaviour
• Companies often fail to learn from experience or from looking at
risks in similar companies (Nick Leeson at Barings also kept middle
office access when he moved to the trading desk)
• Controls are in place in theory, but they are not acted upon in
practice
• Inadequate supervision is a key ingredient in poor risk management
Some lessons
Some Risk Management Traps
Trap 1: Ticking boxes
–In many companies risk management is just a
process we have to go through
–This may minimize our own responsibility,
deflecting risk elsewhere, but risk management
should achieve real improvements
• We can spend too long considering individual scenarios
• Often each individual scenario is very unlikely but we
want to look at the overall behaviour
• For example suppose we want to estimate the risk of a
critical air courier delivery getting delayed
• Should we start by looking at the types of event that will
cause this – like an Iceland volcano eruption, or an air
traffic controllers strike – and then estimate the chance
of each one?
Trap 2: Focusing too much
on unlikely events
Risk managem nt should look at
the interdependencies between
different events
We can overuse historical information in determining future
risk. A long pattern of stability doesn’t always allow us to
correctly estimate probabilities of risk events
◼How safe are we in assuming that the British pound will
not drop to 1.7 $AU ?
