Risk Management and

Business Continuity

MQM - O24

Abeer Youssef
1
 Overview
Risk management process
1) Establishing the context,
2) Risk identification,
3) Risk analysis,
4) Risk evaluation,
5) Risk treatment,
6) Risk monitoring and review, and
7) Communication and consultation.

2
1. Establishing the context involves:
1.1. Define the scope of the process/risk management
context,
1.2. The organisational internal context, and
1.3. The organisational external context.

1.1. Risk management context: It involves risk architecture,

strategy and protocols, the establishment of risk appetite or
risk criteria.

1.2. Organisational internal context: It refers to the

organisation itself, the activities it undertakes, its structure,
culture, the resources that are available.
3
Some elements of the organisational internal context
1.2.1. Business Levels of Strategies
• Corporate level strategy
• Business level strategy
• Functional level strategy
• Operational level strategy

1.2.2. Decision-making approaches

1.2.3. Organisational culture

1.2.4. Organisational design/structure

• Factors affect organisational design

1.2.5. Internal stakeholders

4
Risk management process

5
1- Establishing the context:
This is the foundational step in the risk process. It defines the
external and internal parameters to manage risk and setting the
scope and risk criteria for the rest of the process to customise the
risk management process.

2- Risk identification:
It involves identifying potential risks, threats, and uncertainties
that could affect the organisation's objectives.

3- Risk analysis:
In this step, the identified risks are analysed to determine their
likelihood of occurrence and the potential impact.

4- Risk evaluation:
It evaluates the significance of each risk and prioritises them
based on their likelihood and potential impact.
6
5- Risk treatment:
It involves developing and implementing strategies to mitigate,
transfer, or avoid the identified risks. Strategies include risk
avoidance, risk reduction, risk sharing, and risk acceptance.

6- Risk monitoring and review:

Continuous monitoring and review of the risk management
process to ensure that risks are effectively managed and that new
risks are identified and addressed.

7- Communication and consultation:

Throughout the risk process, effective communication and
consultation with stakeholders, both internal and external, are
crucial. This step ensures that everyone understands the risk
management process and their roles and responsibilities.
7
 1- Establishing the context

• The purpose of this step is to customise the risk

management process to enable effective risk assessment
and appropriate risk treatment.
• A framework is required to implement and support the
risk management process.
• It involves:
o Defining the scope of the process/risk management
context,
o The organisational internal context, and
o The organisational external context.
8
9
1.1. Risk management context
• It is the risk architecture, strategy and protocols or the
risk management framework within the organisation.

• This framework must fulfil two functions:

1) Provide support for the risk management process
within the organisation; and
2) Ensure that the outputs from the risk management
process are communicated to internal and external
stakeholders.

PS: This part will be explained in detail in lecture 7.

10
1.2. Organisational internal context
• It refers to the organisation itself, the activities it
undertakes, the range of skills and capabilities available
within the organisation, and how it is structured.
• It is also about the organisational culture, the resources
that are available, receiving outputs from the risk
management process and ensuring that these influence
behaviours.
• The internal context concerns objectives, the capacity and
capabilities of the organisation, the business strategies, and
how the organisation makes decisions.
• Internal stakeholders and their expectations are part of the
internal context.
• This may be considered the strengths and weaknesses
within the organisation. 11
Some elements of the organisational internal context
1.2.1. Business levels of strategies
1.2.2. Decision-making approaches
1.2.3. Organisational culture
1.2.4. Organisational design/structure
1.2.5. Internal stakeholders

12
1.2.1. Business levels of strategies

13
Business levels of strategies
Form a comprehensive master plan that states how the
corporation will achieve its mission and objectives.
Four levels of strategy as follows:

• Corporate
• Business
• Functional
• Operational (if needed)

14
 Corporate level strategy
• Corporate strategies are the top-level of strategy in an
organisation.

• The corporate strategy defines the organisation’s overall direction

and the high-level ideas of how to move towards it.

• These plans are usually created by a select strategy group such as

the CEO and the top management.

• Generally, this is the group involved because they have a deep

understanding of the company, and the strategic business
knowledge needed to steer the organisation in the right direction.

• A corporate strategy is generally broader than the other strategy

levels. Strategies at this level are more conceptual and futuristic
than business and functional level strategies.
15
 Business level strategy
• The business strategy is the second level of strategies.

• It is a means to achieve the goals of a specific business

unit in the organisation.

• It is useful for organisations with multiple business units

that may sell products and services or may sell multiple
products/services in different industries.

• It emphasises improvement of the competitive position

of a corporation’s products or services in a specific
industry or market.
16
• Business strategies may fit within the two overall categories:
competitive strategies and cooperative strategies.

• For example, Staples, the U.S. office supply store chain, has
used a competitive strategy to differentiate its stores from
competitors by adding services such as copying, UPS shipping,
and hiring technicians who can fix computers and install
networks.

• British Airways has followed a cooperative strategy by forming

an alliance with American Airlines in order to provide global
service.

• Cooperative strategy may provide a competitive advantage.

Intel, a manufacturer of computer microprocessors, uses its
alliance (cooperative strategy) with Microsoft to differentiate
itself (competitive strategy) from AMD, its primary competitor. 17
 Functional level strategy
• This is the level at the operating end of an organisation.

• At this level, decisions made by employees are often described

as tactical decisions. They are concerned with how the various
functions of an organisation contribute to the other strategy
levels.

• These functions can include marketing, finance,

manufacturing, human resources, and more.

• Functional strategy deals with a restrictive plan. It gives the

objectives for each specific function.
18
• This strategy will inform the day-to-day work of
employees and will ultimately keep your organisation
moving in the right direction.

• The functional strategy level is probably the most

important level of strategy.

• This is because, without functional strategies, your

organisation can quickly lose traction and “get stuck”
while competition moves forward.

19
 Operational level strategy
• The role of operations strategy is to provide a plan for the
operations function so that it can make the best use of its
resources.

• Operations strategy specifies the policies; the design,

plans and use of resources to support the business strategy
and its long-term competitive strategy.

• This includes the location, size, and type of facilities

available; worker skills and talents required; use of
technology, special processes needed, special equipment;
and quality control methods.
20
• The operations strategy must be aligned with the
company's business strategy and enable the company
to achieve its long-term plan.

• For example, the business strategy of FedEx, the

world's largest provider of expedited delivery
services, is to compete on time and dependability of
deliveries. The operations strategy of FedEx
developed a plan for resources to support its business
strategy. To provide speed of delivery, FedEx
acquired its own fleet of airplanes.

21
1.2.2. Decision-making approaches

22
 Decision-making approaches
Decision-making approaches are frameworks or models
that guide the process of decision making in
organisations.

These approaches could include:

– Rational decision-making model
– Incremental decision making
– Bounded rationality
– Political decision making
– Intuition decision making (Intuitive model)
23
Rational decision-making model
• It is a systematic approach that aims to optimise decision
outcomes by evaluating alternatives based on objective
criteria.
• This approach assumes that decision makers “behave
intelligently and rationally”.
• It also assumes that decision makers have complete
information, make logical choices, and seek to maximise
value or utility.
• It involves identifying the problem, generating alternative
solutions, evaluating/analysing options (consider
consequences as well), and selecting the best alternative.
24
Incremental decision making
• It involves making decisions in small, manageable
steps based on existing knowledge and experience.
• It recognises that decisions often involve uncertainty
and incomplete information.
• Rather than seeking an optimal solution, this
approach focuses on making gradual improvements,
learning from the outcomes, and adjusting the
decision as new information becomes available.

25
Bounded rationality
• It acknowledges that people are limited by their
mental capacity, the information available, and time.
• It suggests that decisions are often made based on
basic rules rather than exhaustive analysis.
• Instead of striving to make the “best” choices, people
often settle on making merely satisfactory choices. It
means finding a satisfactory solution that meets
minimum criteria rather than searching for the best
possible solution.
26
Political decision making
• It recognises that decisions in organisations involve
various stakeholders with differing interests and
power dynamics.
• It emphasises the influence of politics, negotiations,
and coalitions in shaping decisions.
• This approach considers the importance of managing
relationships, building consensus, and
accommodating diverse perspectives.

27
Intuition decision making (Intuitive model)
• Intuition-based decision making relies on the
experience and judgment of decision-makers.
• It involves relying on tacit knowledge and gut
feelings to make decisions. Decision makers
sometimes decide to do something because it feels
“right”.
• This approach is often used in situations where time
is limited, information is ambiguous, or decisions
require creativity and pattern recognition.

28
 Activity: Scavenger hunt

• Scavenger hunt checklist includes a list of concepts,

which are:
o Incremental decision making,
o Political decision making,
o Corporate level strategy,
o Business level strategy,
o Functional level strategy, and
o Operational level strategy.

29
• It is required to search for examples or real-life
instances of each concept within a given 15 minutes
time frame.

• You can use smartphones or other devices to gather

information and take pictures or screenshots as
evidence for each concept.

• The team that completes the scavenger hunt checklist

first or collects the most accurate examples wins the
game.

30
1.2.3. Organisational culture

31
Organisational culture (behaviour)
“This is the way we do
things around here.”

“Culture eats strategy for

breakfast, eats action plans
for lunch and eats
everything else for dinner”,
Peter Drucker.
32
• Organisational culture consists of the goals, ideals,
norms and standards that make up an organisation’s
values.

• It develops over time and is transmitted through both

formal and informal practices. It becomes part of the
fabric of the organisation.

• Leaders nurture that culture. They become its guardian

and embody the values of the organisation.
Organisational culture is not always good, and the
deeper it is embedded the more difficult it is to change.
33
• Research shows that leadership has a crucial role in
setting a healthy culture in the organisation and leaders
are expected to behave honestly, practice what they
preach, treat staff fairly and respectfully, and encourage
others to act autonomously.

• Fostering a culture of innovation, collaboration,

adaptability, and ethical behaviour supports strategic
management effectiveness and organisational
resilience.

• However, culture is a complex phenomenon.

34
1.2.4. Organisational design/structure

35
 Organisational design (structure)

• Organisational design is engaged when

managers/leaders develop or change an
organisation’s structure.

• It is basically the process of constructing and

adjusting an organisation’s structure to achieve its
goals.

36
 Factors affect organisational design

Six key factors affect an organisational design, which are

as follows:
• Work specialisation,
• Departmentalisation,
• Chain of command,
• Span of control,
• Centralisation and decentralisation,
• Formalisation.

37
1- Work specialisation
The degree to which tasks in
the organisation are divided
into separate jobs with each
step completed by a different
person.

38
 2- Departmentalisation
• It is the process of grouping activities into
departments.

• Division of labours creates specialists who need

coordination.

• This coordination is facilitated by grouping

specialists together in departments.

39
Types of departmentation

a) Functional: Grouping
jobs by functions
performed.

40
b) Product:
Grouping jobs
by product
line.

41
c) Geographical:
Grouping jobs
on the basis of
territory or
geography.

42
d) Process or
equipment: Grouping
jobs on the basis of
equipment types and
production process.

It is found in
manufacturing
organisations in
which parts of the
production process
are segregated to
improve efficiency in
the system. 43
e) Customer: Grouping jobs by type of
customers and needs.

44
 3- Chain of command

• A corporate chain of command is a hierarchy that

outlines who reports to whom, as well as the roles each
person has within the organisation.

• It's important because it allows everyone to know their

place within the organisation and who they should go
to with questions or concerns.

45
 4- Span of control
• Span of control refers to the number of subordinates
(managerial levels) that can be managed effectively and
efficiently by supervisors or managers in an organisation.

• Typically, it is either narrow or wide resulting in a flatter or

more hierarchical organisational structure.

• It affects the company's effectiveness in managing the

company. For example, it impacts flexibility and
communication within the organisation. When the span of
control is wider, communication flows more quickly between
levels, enabling faster decision-making.
46
47
 5- Centralisation and decentralisation
• Centralisation is the degree to which formal authority is
concentrated in one point or level of the organisation. In a
highly centralised structure, top management makes most of the
key decisions in the organisation, with very little input from
lower-level employees.

• Unlike, decentralisation is the systematic delegation of authority

in an organisation.

• Employee empowerment is increasing the decision-making

discretion of employees.

• Centralisation is best for a small sized organisation, but the

large sized organisation should practice decentralisation. 48
 6- Formalisation
• Formalisation is the degree to which fixed rules and
procedures dictate how employees should behave.

• It is the degree to which an organisational processes, job

descriptions and policies are expressed or well-written.

• Characteristics of a highly formalised organisation are as

follows:

1) Employee behaviour in the organisation is

predictable and consistent.
49
2) There is minimisation of ambiguity in work and a
sense of direction among employees.

3) It is constructed by the top management to

encourage quick and smooth accomplishment of
goals.

4) A highly formalised organisation may experience

lack of motivation and job satisfaction among
employees.

5) More constraints on how employees do their work.

50
1.2.5. Internal stakeholders

51
• These internal stakeholders are part of the organisation itself
and have a direct interest and involvement in the
organisation's risk management activities.

• Internal stakeholders could include:

➢ Shareholders and investors,
➢ Board of directors,
➢ Managers and executives (department/functional
heads, project managers, etc.),
➢ Employees at all levels,
➢ Risk management team,
➢ Internal audit function, and
➢ Compliance and legal teams.
52
 Recap
Risk management process: Although there are many ways of
representing the risk management process, the basic steps are all
similar.
1) Establishing the context,
2) Risk identification,
3) Risk analysis,
4) Risk evaluation,
5) Risk treatment,
6) Risk monitoring and review, and
7) Communication and consultation

53
1. Establishing the context: It involves:
1.1. Define the scope of the process/risk management
context,
1.2. The organisational internal context, and
1.3. The organisational external context.

1.1. Risk management context

• It has been described as the risk architecture, strategy
and protocols or the risk management framework within
the organisation.
• It involves the establishment of risk appetite or risk
criteria.
54
1.2. Organisational internal context
It refers to the organisation itself, the activities it undertakes,
its structure, culture, the resources that are available.

Some elements of the organisational internal context

1.2.1. Business levels of strategies
1.2.2. Decision-making approaches
1.2.3. Organisational culture
1.2.4. Organisational design/structure
1.2.5. Internal stakeholders

55
Some elements of the organisational internal context
1.2.1. Business Levels of Strategies
• Corporate level strategy: Top-level of strategy that
defines the organisation’s overall direction
• Business level strategy: It is a means to achieve the
goals of a corporate
• Functional level strategy: Tactical decisions that shows
day-to-day work.
• Operational (if needed) level strategy: It specifies the
policies; the design, plans and use of resources to
support the long-term competitive strategy.
56
1.2.2. Decision-making approaches
• Rational decision-making model
• Incremental decision making
• Bounded rationality
• Political decision making
• Intuition decision making (Intuitive model)

1.2.3. Organisational culture (behaviour)

It consists of the goals, ideals, norms and standards that make up
an organisation’s values.

1.2.4. Organisational design/structure

The process of constructing and adjusting an organisation’s
structure to achieve its goals.
57
Factors affect organisational design
➢ Work specialisation,
➢ Departmentalisation,
➢ Chain of command,
➢ Span of control,
➢ Centralisation and decentralisation,
➢ Formalisation.

1.2.5. Internal stakeholders

These internal stakeholders are part of the organisation itself
and have a direct interest and involvement in the
organisation's risk management activities.
58
Thank you

59