Risk
Management
cases and tools
Dr. Ravi Jaiswal
PGDIM, PhD. UGC NET
Fellow III
Risk Responses
Strategy Description Example
Avoid Stop activity Exit market
Reduce Internal controls System upgrade
Transfer Insurance Fire policy, reinsurance
Accept Retain Arrangements
Business Risk scenarios…
Strategic Risks – Business model, competition, policy shifts, ???
Operational Risks – Internal processes, human error, systems
Financial Risks – Liquidity, credit, market volatility
Compliance Risks – Legal, regulatory, governance issues
Reputational Risks – Brand damage, stakeholder trust
Technological & Environmental Risks – Cyber, sustainability, ESG
Examples: Strategic (Nokia), Operational (Infosys outage), Financial (Yes Bank),
Reputational (Adani post-Hindenburg).
Understand…
Risk-Reward Balance
Optimize, don’t eliminate
Risk Appetite & Tolerance
Appetite: Willingness to take risk
Tolerance: Acceptable variation
Risk Culture: Its all about understanding the risks and move
ahead with proper treatment.
Case Study: Zomato
Strategic: Discount-driven model risk
Operational: Partner delivery issues
Financial: Profitability challenges
Reputation: Social media backlash
Case Study: Tata Motors
High strategic dependency on Jaguar Land Rover (JLR) exposes Tata
Motors to regional market fluctuations, especially in Europe.
European market slowdown and regulatory pressures significantly
affect JLR’s sales and overall group profitability.
Operational disruptions due to global semiconductor shortages have
reduced vehicle production and delayed deliveries.
Supply chain vulnerabilities across electronics and imported
components further increase operational risk.
Currency exposure, especially GBP and EUR volatility, directly impacts
earnings, cash flows, and consolidated financial performance.
Case Study: Satyam Computers
Massive internal fraud where the promoter Ramalinga Raju falsified
revenues, cash balances, and profits for years (₹7,000+ crore scam).
Failure of internal controls and audits, including collusion and lack
of independent verification by internal and external auditors.
Weak corporate governance, with the board approving suspicious
related-party transactions (e.g., MAYTAS deal) without due
diligence.
Severe reputational and financial damage, leading to a sharp fall in
stock price, loss of client confidence, and regulatory investigations.
Government intervention and takeover, resulting in Tech Mahindra
acquiring Satyam to restore stability and protect employees and
customers
Tools
Building a Risk Matrix Steps: Identify → Rate →
Multiply → Prioritize
Risk Heat Map Example Visual grid (cyberattack,
vendor failure, compliance breach)
Sensitivity & Scenario Analysis
What-if modelling
Stress testing
Value at Risk (VaR)
Measures maximum expected loss
Monte Carlo Simulation
Scenario generation → probability distribution
What-if modelling
What-if modelling is a decision-support technique
used to see how changes in key inputs affect the
outcome.
You change one or more variables (e.g., interest rate,
sales volume, cost).
The model shows how the result changes (profit, cash
flow, risk).
Helps identify sensitivity, potential risks, and
best/worst-case outcomes.
Useful in budgeting, pricing, forecasting, project
evaluation, and risk analysis.
What if we increase the price by 10%?
What if we reduce the price by 5% but sell more
units?
What if supplier cost increases by ₹20 per item?
Example What if interest rates rise by 2%—how will our loan
cost change?
Explanation:
The company uses a spreadsheet model to modify inputs
like price, cost, and expected sales volume. The model
immediately shows the new revenue, profit margin, and
breakeven point. This helps managers select the best
pricing strategy, identify risk areas, and plan for different
demand scenarios.
Stress testing evaluates how a system, portfolio, or
business performs under extreme, adverse, and
unlikely scenarios.
It applies shocks like a market crash, recession,
cyberattack, pandemic, or interest-rate spike.
Stress Tests resilience and identifies weaknesses under severe
pressures.
Testing Used by banks, insurers, regulators, and project teams.
Helps ensure the organisation can survive worst-case
conditions. (Level of Confidence…)
Example
The bank simulates this extreme shock scenario to evaluate whether it still
meets regulatory capital requirements (like Basel norms).
If the stress test shows major losses, the bank will take corrective actions—
reducing risky exposures, increasing capital buffers, or hedging positions.
This ensures the organization can survive a crisis even if the event is rare.
Value at Risk (VaR) is a risk measurement
technique that estimates the maximum expected
loss of a portfolio or asset over a given time
period, at a specified confidence level.
Value at Risk VaR answers the question:
“What is the most I can lose, with X%
(VaR) confidence, over Y time?”
For example:
1-day VaR @ 95% = ₹10 crore
means: There is a 95% chance the loss will NOT
exceed ₹10 crore in one day.
Used by banks, insurers,
traders, and regulators.
Helps quantify market risk in
a single number.
Applications Time horizons often used: 1
day, 10 days, or 1 month.
Confidence levels usually:
95%, 99%.
A technique that uses random sampling to model
uncertainty and variability in outcomes.
Runs a model thousands of times, each time using
different random values for uncertain inputs.
Monte Carlo Produces a range of possible outcomes rather
than a single point estimate.
Simulation Helps in risk analysis, decision-making, and
forecasting under uncertainty.
Widely used in finance, insurance, engineering,
project management, and strategy.
It helps decision-makers understand risk,
variability, and worst-case scenarios.
Enterprise Risk Management (ERM)
Integrated Cross-functional, strategic alignment
• COSO ERM Framework-Committee of Sponsoring Organizations of the
Risk Treadway Commission (COSO)
Governance, Strategy, Performance, Review, Communication
Management • ISO 31000, 14001 Principles
Integrated, structured, continuous
& Future • Linking Risk & Strategy
Trends Align appetite with KPIs/KRIs
• How to Define CRO Role
Risk culture and reporting
Integration:
Risk management should be a part of all organizational
activities, processes, and decision-making.
Structured and Comprehensive:
The 8 A systematic and consistent approach ensures efficient and
reliable outcomes.
Principals of Customized:
ISO 31000 The approach must be tailored to the organization's specific
context, objectives, and culture.
Inclusive:
All relevant stakeholders should be engaged to provide diverse
perspectives and enhance buy-in.
Dynamic:
The risk management framework must be adaptable to changes
in the internal and external environment.
Based on Best Available Information:
The 8 Decisions should be made using accurate and timely data, while
acknowledging its limitations.
Principals of Considers Human and Cultural Factors:
ISO 31000 The approach must take into account the behaviors, values, and
attitudes of people within the organization.
Continual Improvement:
Processes should be continually reviewed and improved based
on lessons learned and feedback.
Key Elements
of ISO 14001
Handling Operational risk
Key Challenges Today
Operational High dependency on digital systems
Risk Supply chain disruptions
Increasing cyber-attacks
Risk of loss resulting from
inadequate/failed internal Third-party/vendor failures
processes, people, systems,
or external events.
AI-driven decision failures
Regulatory pressure (BIS, IRDAI, RBI, SEBI, Forums)
People Risk – employee errors, misconduct, lack of training- Satyam, PNB-
Neerav Modi Case
Process Failures – incorrect process design, SOP gaps- Toyota Car call back,
Samsung Mobile explosions
Major
Technology Risk – system outages, cyber attacks, data breach- Airline Hacks,
A massive leak of ~750 million user records of Indian telecom subscribers was
reported in Jan 2024, “Dance of the Hillary” Malware Spread for data steal.
Categories External Risk – Natural events, geopolitical disruptions- Marine and Sea
Events including Pirates in African countries
Model Risk – incorrect assumptions, AI/ML model drift- Sellers Tax data-
Amazon, Loss of the spacecraft by NASA.
Third-Party/Outsourcing Risk – vendor failure, cloud downtime- Tata E-
Vehicles, Scarcity of Rare earth elements.
Risk & Control Self Assessment (RCSA)
Tools & Identify high-risk processes
Frameworks Evaluate controls
for
Operational Score impact × likelihood
Risk Heat map generation
Handling Red flags
Preventive Approach
Bow-Tie Analysis
Preventive Barriers (Left Side)
Impact Controls (Right Side)
Clear cause–effect–consequence model
Scenario Analysis
Worst-case event simulation
Probability × Severity costing
Regulatory requirement (Basel norms)
Monte Carlo Simulation (Advanced)
Uncertainty modeling
Simulates 10,000+ operational failure events
Generates expected loss distribution
Preventive Approach
Incident & Loss Data Management
Track root-cause
Map recurring failures
Used for capital calculation (Basel/ORSA)
Stress Testing Operational Events
Examples:
Data centre outage for 12 hours
30-40% workforce unavailability
Vendor insolvency
Banking & Financial Services
Operational Risk Context
Fraud, cyber-attacks, ATM outages
System downtime affecting transactions
Regulatory compliance failures
Real Example: HDFC Bank Outage Case
Multiple digital outages (2020–21)
RBI froze new credit card issuance
Weak capacity planning = operational failure
Tools Applied
IT Risk Scorecards
KRI Tracking (Downtime hours, failed UPI transactions)
Stress test: 3-hour digital outage scenario
Risk and Control Self-Assessment (RCSA) for core banking systems
Manufacturing & Engineering
Firms
Operational Risks
Equipment failure
Safety lapses
Supply chain breakdown
QC testing failures
Case: Toyota Chip Shortage (2021)
Global semiconductor disruption
Just-In-Time model weakness exposed- break part supply
interruption ( 20 Units halted their operations)
Tools Applied
FMEA (Failure Mode & Effects Analysis)
Predictive maintenance using sensors
Vendor risk matrix (A/B/C vendor classes)
E-commerce / Food Delivery
(Zomato, Amazon)
Operational Risks
Failed delivery
Payment gateway errors
Vendor misconduct
Surge algorithm glitches
Case Example: Zomato Partner Strike
Large-scale delivery disruptions
Customer dissatisfaction spike
Tools Applied
Workforce KRI – delivery acceptance rate
Real-time dashboards
Geo-mapping hotspot analysis
Live Exercise
“The Incident Room – Operational Risk Response Drill”
You are:
Incident Manager
Operations Lead
Technology Lead
Risk Officer
Communications & PR Manager
Vendor/Partner Liaison
Legal & Compliance Officer
SCENARIO:
An e-commerce platform (“ShopKart”) is running its Big Festive Sale.
At 10:35 AM, the dashboard shows:
Sudden spike in failed payments
2000+ orders stuck in the “processing” state
Complaints flooding on Twitter & Instagram
Vendor SLA breach from logistics partner (no trucks available)
Warehouse system shows mismatch in stock (inventory error = 18%)
A rumor spreading online that “ShopKart is hacked and customer data leaked”
Stimulator
Payment gateway provider confirms “intermittent API failures”.
News blogger tweets alleged “data leak screenshot”.
One warehouse CCTV shows staff mishandling high-value phones.
100 high-value orders cancelled automatically due to stock mismatch.
Regulator sends a notice asking for incident explanation within 24 hrs.
Team Work
Identify all operational risks.
Categorize team (People/Process/Tech/External/Vendor/Fraud).
Prioritize the critical 3 risks.
Prepare Incident Action Plan:
Immediate actions (0–30 min)
Interim controls (30–90 min)
Communication plan (Internal + Customer + Media)
Regulatory handling
Root cause assumptions
Data points what they still need
Live Exercise
“The Incident Room – Operational Risk Response Drill”
QuickBite is India’s second-largest food delivery platform.
On a Saturday evening at 7:20 PM (peak time), these incidents occur simultaneously:
Operational Risk Events
1500+ live orders not assigned to delivery partners
App payment failures (UPI + wallet) rising sharply
Major cloud kitchen partner reports “no order received” despite app showing
orders confirmed
Social media flooded with complaints: “QuickBite is cheating, taking money but
no delivery”
Restaurant partners complaining of high cancellation rate