Stage 4: Form a risk mitigation strategy
A risk mitigation strategy involves choosing among four major alternatives for dealing with the identified risks:
We will discuss in more detail the ways in which financial risks can be transferred or mitigated. It is important to understand, though, that decisions must also be made as to whether risks should be avoided or kept: a process that is known as ‘allocating risk capacity’.
A first step in allocating risk is to rank the risks previously identified. A useful way to do this is to separate them into the following groups:
- risk unavoidable except by ceasing core activity
- avoidable risk, core activities
- avoidable risk, non-core activities
- selectable risk.
The intention is to help management by giving a sequence for consideration: that is, Group 1 ‘uses up’ some of the risk capacity before you can consider Groups 2 to 4, and so on.
Group 1 relates to risks that have to be run if an organisation wishes to conduct a core activity.
Group 2 relates to risks that can be avoided, if desired, in respect of an organisation’s core business activities.
Group 3 relates to risks that can be avoided, if desired, in respect of an organisation’s non-core business activities.
Group 4 relates to risks that an organisation can run (with a view to making money) if it chooses or can avoid without any impact on its core or non-core business.
Group 4 needs some further clarification. It is the set for types of risk where the degree of risk can be adjusted more or less voluntarily without changing the operations of the business. The classic example would be financial gearing – where the management can, at least in the medium term, choose the debt/equity ratio without altering the company’s activities.
Some risk elements can appear in both Group 4 and elsewhere. For example, it may be necessary to accept some foreign currency risk as a concomitant to doing business (Group 2). But the organisation could also take on foreign currency risk that was essentially speculative – that part would be Group 4. In effect, Group 4 can be regarded as a ‘balancing item’ between the total risk represented by the main business and the capacity for risk decided upon as acceptable by the management.