Managing Opportunities and Risks - CIMA

1 ManagingOpportunities and RisksByTamara Bekefi, Marc J. EpsteinandKristi YuthasMANAGEMENT ACCOUNTING GUIDELINEMANAGEMENTSTRATEGYMEASUREMENTP ublished by The Society of Management Accountants of Canada, the AmericanInstitute of Certified Public Accountants and The Chartered Institute ofManagement 2008 by The Society of Management Accountants of Canada (CMA Canada), the American Institute of CertifiedPublic Accountants, Inc. (AICPA) and The Chartered Institute of Management Accountants (CIMA). All Rights part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, withoutthe prior written consent of the publisher or a licence from The Canadian Copyright Licensing Agency (Access Copyright).For an Access Copyright Licence, visit or call toll free to 1 800 893 : 1-55302-212-2 NOTICE TO READERSThe material contained in the Management Accounting Guideline Managing Opportunities and Risks is designed to provideillustrative information with respect to the subject matter covered.

2 It does not establish standards or preferred has not been considered or acted upon by any senior or technical committees or the board of directors of either theAICPA, CIMA or The Society of Management Accountants of Canada and does not represent an official opinion or position ofeither the AICPA, CIMA or The Society of Management Accountants of Risk taking, the engine driving business,is vital to companies seeking marketsuccess. Risks are, however, often thoughtof only as hazards, despite the fact thatthey can present significant opportunitiesand possibilities for organizationalinnovation and new competitive advantageleading to short- and long-term profita-bility. In fact, risk and opportunity are aduality like two sides to the same hazardous risk has beenincreasingly recognized as a criticalbusiness issue prompted by events asdiverse as the financial debacles ofcompanies like Enron,Worldcom, andParmalat, the terrorist events ofSeptember 11, 2001, and the hurricanedisaster of Katrina in 2005.

3 CMA Canada,the AICPA, and CIMA have respondedwith four Guidelines that address thisissue:a) Identifying, Measuring, and ManagingOrganizational Risks for ImprovedPerformance ;b) The Reporting of Organizational Risks for Internal and ExternalDecision Making ;c) Integrating Social and Political Riskinto Management Decision Making ;andd) Business Continuity Management .Though these four ManagementAccounting Guidelines on risk provideexcellent coverage of many of the mostMANAGING Opportunities AND RISKSCONTENTS EXECUTIVE SUMMARYR ecent corporate financial debacles, the threat ofglobal terrorism, and other social, political andenvironmental issues have prompted an increasedrecognition of hazardous risk as a critical the awareness of risk as a threat isimperative, so too is the recognition that Risks canprovide Opportunities for innovation leading tonew competitive Guideline builds on previous Guidelines onrisk, but focuses on the Opportunities created by organizational Risks .

4 It provides insights into the positive aspects of risk and views the riskmanagement process as a way to exploitopportunities and drive new organizationalinnovation. It also provides tools and recommen-dations to financial professionals on how todevelop a risk and opportunity managementframework, measures, and management processto drive innovation and win in the ROLE OF FINANCIAL PROFESSIONALS5 BACKGROUND5 MODEL FOR RISK & OPPORTUNITYMANAGEMENT71. IDENTIFYING Risks & OPPORTUNITIES92. Managing Risks & OPPORTUNITIES173. EVALUATING RISK & OPPORTUNITYTHROUGH ROI AND OTHER METHODS29 CONCLUSION33 ENDNOTES34 BIBLIOGRAPHY36 Page3 MANAGEMENT4critical issues in risk management, they conceptua-lize risk as it is typically defined as a examine how organizations canprotect themselves against various Risks bypreparing for, mitigating, and responding to Guidelines do not, however, elaborate onthe fact that Risks are not only hazards that shouldbe avoided but are also Opportunities that propelbusiness growth.

5 By focusing on the downside ofrisk, companies can sometimes forego opportuni-ties that might initially appear too risky, but whichhave never been formally Guideline builds on the previous guidelines by focusing on the importance of risk and opportunity management and the value-creationopportunities often hidden in Risks . It aims to help create a more rigorous understanding of therisks that organizations take and provide tools tobetter evaluate and manage Opportunities relatedto taking Guideline suggests a methodfor avoiding hazardous Risks or minimizing theirimpacts while proactively seeking opportunitiesand Risks that can reward the organization. Ittouches on three different, yet related, pursuits:1) Identifying and Managing Risks discussed astraditional risk management in otherManagement Accounting Guidelines,2) Identifying and Managing Opportunities , oftenrelated to innovation, and Managing relatedrisks, and 3) Identifying and Managing Opportunities whereothers see only unmanageable essence, this piece gives guidance on how todevelop the capacity to minimize unrewardedrisk1 Risks that have no upside even whenhandled perfectly, and maximize rewarded risk Risks that present Opportunities for success, todevelop an ambidextrous organization.

6 Somecompanies with superior organizational knowledgeand capabilities can accept Risks and mitigate themeffectively while their competitors may choose to avoid potential investments due to a low riskappetite or a narrow assessment of Risks . Inaddition, organizations may be able to identifyvoids in the marketplace that provideopportunities for innovation others may not guideline articulates the positive aspects ofrisk management and how to capture opportunitythrough innovation. It views the process andoutput of risk and opportunity management as a source of competitive advantage and a way tosuccessfully navigate charted and unchartedwaters to drive new organizational also provides recommendations to financialprofessionals on how they can expand the riskmanagement framework, measures, and manage-ment processes to capture Opportunities and gaincompetitive advantage. Financial professionals havea critical role in risk and opportunity managementas the creators and designers of systems thatestablish key performance indicators and measureperformance against Risks and Opportunities is, in many ways,separate from the daily toils of business, andSTRATEGYMEASUREMENTMANAGEMENTE xhibit 1.

7 Risk & Opportunity Management Continuum2 Improved returns through improved risk & opportunity managementEnhancing capital allocationProtecting corporate relationsAchieving global best practicesUnderstanding and evaluating business strategy Risks & opportunitiesUnderstanding the full range of Risks & Opportunities facing businessAvoiding personal liability failure (the personal fear factor)Compliance with corporate governance standards (fiduciary responsibility)Other company crisesOwn company crisesComplianceand PreventionOperatingPerformanceShareholde r ValueEnhancement{{{GreaterSophistication Managing Opportunities AND RISKS5therefore necessitates an explicit effort to stepback and see the full risk and opportunity risk and opportunity is a continuum,illustrated in Exhibit 1, which is increasingly related to strategy, operating performance, andshareholder value enhancement, in addition tocompliance and ManagementAccounting Guideline describes a best practiceand we acknowledge that risk and opportunitymanagement described here is a journey.}}}

8 Not all organizations will be able to undertake thepractice as described. But even those who cannot,may still use this piece to help sensitize theirmanagement to begin broadening the approach to risk rather than focusing exclusively on risk as a ROLE OF FINANCIALPROFESSIONALSThe role of financial professionals in capturing and capitalizing on Opportunities related to riskcannot be overstated. The corporate finance andaccounting functions may not have full ownershipof the risk and opportunity management processbut they do possess the strategic vision, riskmanagement expertise, financial managementdiscipline, project management skills, andcomprehensive perspective essential to improvingthe effectiveness and efficiency of risk andopportunity management. Management of theseissues is heavily grounded in the role of financialprofessionals because of their contribution to 1) designing, implementing and overseeing thetechnical aspects of the process described in thisGuideline, and 2) informing the Board of thisprocess and its outcome.

9 Financial professionalscan develop approaches to identifying andmeasuring Opportunities and Risks , contributing in six essential ways:1) Establishing guidelines and procedures forstrategic planning around Opportunities andrisks;2) Improving the identification, measurement, andmanagement of Risks and Opportunities ;3) Preparing the evaluation;4) Integrating the model;5) Training managers to make more effectiveevaluations of Risks and Opportunities ; and6) Implementing processes to monitor andcommunicate business Risks and BACKGROUND In Identifying, Measuring, and Managing Organiza-tional Risks for Improved Performance , Marc and Adriana Rejc-Buhovac present amodel and measures for enhancing the identifica-tion and measurement of Risks for improvedmanagement decisions. Stemming from the riskassessment requirements of the 2002 Sarbanes-Oxley Act in the , and similar new regulationsin other countries, it also builds on the TreadwayCommission s Committee of SponsoringOrganizations (COSO) Internal ControlIntegrated Framework , and its more recentlyissued Enterprise Risk Management IntegratedFramework.

10 Epstein and Rejc-Buhovac s workfurther specifies the tools necessary for organi-zations to identify and measure a broad set ofrisks. More significantly, however, it concentrateson improving the quality and effectiveness of bothoperational and capital investment decisions,through more effective management of organi-zational and Rejc-Buhovac demonstrated thatincreased measurement of a broader set of risksis necessary, both to meet recent regulatoryrequirements and to improve managerialperformance and stakeholder a six-step risk assessment model,illustrated in Exhibit 2, which builds on the 2004 COSO Enterprise Risk Management IntegratedFramework,and includes:1) Event Identification2) Risk Assessment3) Risk Response4) Control Activities5) Information & Communication, and 6) MonitoringThis Guideline builds on the previous guidelineson risk, expanding the risk assessment model toinclude Opportunities and innovation, and providesthe needed tools and techniques to capture thepositive side of risk while rigorously Managing itsdownside impacts.