“Do not waste all your arrows on little sparrows”, this statement is applicable in risk management. The level of resources (time and money) that a firm should allocate to risk management should be commensurate with the risk. In our last article, we highlighted that firms should take a holistic approach in identifying negative unforeseen events that can strike their business (risk). Risk identification should be done across the whole value chain, that is, from suppliers, customers, competitors, substitute producers, possible new entrants, the firm itself and the environment at large. Having identified all the possible risks, the next step is to analyse them in terms of how often they are likely to strike (Frequency) and the quantity of loss in dollars terms if they strike (Impact). In Risk Analysis, a combination of frequency and impact is known as ‘Risk Magnitude’. Identified risks are then ranked according to ‘risk magnitude’ starting with the biggest risks.
Risk analysis is important for organisations in order to determine the levels of resources that can be allocated in managing risks. There are basically three methods which can be used to analyse identified risks namely qualitative methods, semi-quantitative methods and quantitative methods.
Qualitative risk analysis methods
In qualitative risk analysis, organisations use judgement, experience and intuition for decision making. Qualitative analysis is used when the level of exposure does not warrant full analysis and there is available experience required to make meaningful decisions. This method is also used when numerical data is not readily available and is sometimes used as a basis for carrying out further quantitative research. For example, an organisation which is concerned about levels of theft in an area they want to start new business operations may do the following:
- Carry out brainstorming sessions with experienced employees working in that area – ask questions relating to previous experience of theft.
- Interview security guards in the surrounding area
- Use questionnaires and structured interviews to get responses from experienced staff members.
- Interview specialists who can give their responses based on experience and gut feeling.
The major disadvantage is that qualitative analysis may not be that accurate but it saves resources. It must only be used if the level of risk does not warrant full scale investigation.
Semi- quantitative risk analysis methods
This is a combination of qualitative and quantitative methods. In this case, the risk magnitude is classified into broad classes such as high, medium or low. Some organisations use colours to depict the level of risk. For example:
- RED – higher risk magnitude, that is, more resources in terms of time and money should be allocated in managing that risk.
- YELLOW – Medium risk, that is, medium resources in terms of time and money should be allocated in managing that risk.
- GREEN – Low risk, that is, lower resources in terms of time and money should be allocated to that risk.
The semi- quantitative approach is ahead of qualitative method in that it attempts to classify risks into broad categories. The disadvantage is that it relies on human judgement on whether a risk falls into a higher risk category of lower one.
Quantitative risk analysis methods
Quantitative risk analysis is a statistical approach which enables organisations to assign a specific value to the risk magnitude of the risks identified. Quantitative risk analysis gives the actual chances of loss (probability of a risk occurring) and the quantity of loss in dollar terms if the risk strikes. The chances of a risk striking can be generated using past experiences and forecasting them into the future with the aid of computer generated simulations and statistical programs. Quantitative methods are a step ahead of semi-quantitative methods. However, the results may not predict the future with full accuracy as nature is very difficult to predict 100%.
Risk Analysis is a very important component of risk management as it gives management an insight of how much money should be allocated in managing risks and how much time. Organisations can use internal resources or hire external risk management experts to carry out a comprehensive risk identification and risk analysis project. “Do not waste arrows on little sparrows”
Joey Shumbamhini is the Principal Officer for CBZ Risk Advisory Services (Pvt) Limited. He writes in his own capacity. For feedback relating to this article you can contact him on simonsays@cbz.co.zw
