1. Governance for SMEs Nigeria
MANAGING RISK
Governance for SMEs Nigeria

2. Rules Review each of the rules. Participants are required:
To be on time
To turn off mobile phones or set them to vibrate
Not to smoke in class
To have tea or beverages only during breaks
Inform participants about:
The schedule
Break time
Toilets
Emergency exits

3. Methods of Learning Introduce the learning methods: Explanation
Discussion
Questions & Answers
Case study
Games
Presentation
Practice

4. Objectives At the end of this training, you will be able to:
Define risk management and its benefits to your business
Develop a risk management framework and processes to manage risk in your business

5. Content Risk management and its benefits to SMEs
Risk management process
Implementing risk management

6. Risk management and its benefits to SMEs
Session 1
Risk management and its benefits to SMEs

7. Session 1: Objectives Describe the nature of risk
Define risk management
Identify benefits of risk management to SMEs

8. Session 1: Content
Risk management
Benefits of risk management

9. What can be considered risk?
Risk is the potential that an event, action or inaction will threaten an organisation’s ability to achieve its objectives.
Downside risk
Upside risk
All organizations face internal and external factors that make it uncertain whether and when they will meet their objectives. The effect of this uncertainty on achieving objectives is called risk. Do you actually know what the business goals are? Very often SME leaders think that this is not required for a business their size and that they are the only ones who should know where they are going. This is only true if your business is a one-man show.
All employees should know what the business objectives are and they will then be able to identify the risks associated with those business goals and focus on those that will prevent them from reaching those business goals. If a risk is not going to prevent you from reaching such targets, it is not a risk to worry about.
Most people when talking about risk only look at the negative aspects of risk. They fail to see the risk involved in being too successful at what you are doing. This is often classified as a business opportunity e.g. a mobile telecommunications company runs a promotion that leads to oversubscribing and hence the systems crashing and customers not being able to make and receive calls.
Boards need to be aware of the ‘upside’ risks and plan for them in the same way that they are planning for the ‘downside’ risks. They need to be aware of the financial and operational impact (customer service, reputation, regulatory) if their project is too successful. What is the tolerance level for the project or activity? They need to be aware of the resource requirements: staffing, technology, equipment and documentation that are needed for the project/activity to be operationally sustainable. They need to ensure that measures are in place to monitor that these requirements are being maintained so not to adversely affect the business.
Upside Risk usually reflects itself in an impact on the company’s reputation.

10. What is risk management?
Risk Management is the process of:
identifying
assessing
and responding
to potential risks facing an organisation.
Ensure that risks are consciously taken with complete knowledge and clear understanding.
Common misunderstanding about risk management:
Risk management means identifying and preventing risk taking
Risk management means eliminating risks
Risk management means buying insurance
Only banks or financial institutions have to worry about risk.
The objective of risk management is not to prevent or prohibit risk taking, but to ensure that the risks are consciously taken with complete knowledge and clear understanding so that it can be measured to help in mitigation.

11. Benefits of risk management
Operational performance
Better achieve business objectives
Improve business performance and process
Minimize operational surprises and losses
Build goodwill
Financial performance
Protect and enhance value
Get better credit rating
Build stakeholder confidence
Reduce insurance premiums
Decision- making
Enable informed decisions
Facilitate assurance and transparency of risk
Better optimize risks
An organization implements strategies in order to reach their goals. Each strategy has related risks that must be managed in order to meet these goals. Risk management allows organizations to reach their goals. In particular, risk management bring the following benefits:
for Operational Performance:
Increases (reduces) the likelihood of (not) achieving business objectives
Uses incidents to highlight the risk environment and helps management to enhance risk awareness and develop performance indicators or risk indicators to improve business performance and processes
Facilitates the monitoring and mitigation of risk in key projects and initiatives
Provides a platform for regulatory compliance and building goodwill
for Financial Performance:
Protects and enhances value by prioritizing and focusing attention on managing risk across the organisation
Contributes to a better credit rating as agencies increasingly focus upon enterprise risk management
Builds investor and stakeholder and regulator confidence, and shareowner value
Reduces insurance premiums through demonstrating a structured risk-management approach
for decision-making:
Shares risk information across the organisation, contributing to informed decisions
Facilitates assurance and transparency of risks at board level
Enables decisions to be made against impact of risks and the organisation’s risk tolerance

12. Risk management process
Session 2
Risk management process

13. Session 2: Objectives Describe risk management steps
Determine methods of identifying risk
Practice steps of risk management process
Explain the importance of determining the risk appetite and the risk tolerance of your business

14. Session 2: Content Risk management process Methods to identify risk
Risk assessment matrix
Strategies to response to risk
Risk monitoring and reports
Evaluation of risk management process
Risk appetite/tolerance

15. Risk management process
Risk identification
Risk assessment
Risk response
Monitoring and Reporting
Evaluation

16. How to identify risk?
Brainstorm for risks associated with business goals
Use a standard risks checklists
Process map your organization
- Some risks are common to most or all businesses. Others are very specific to your business and only you as the owner can know them. The best way to approach this is to use a standard risks checklist as a start and then add to it based on your specific expertise.
- At a Board meeting give out a piece of paper to every board member and ask them to write the top five risks for the organisation. This should be done anonymously and with no conferring. You should then collect up all the pieces of paper and list out on a flip chart the risks which have been identified. Following a board discussion on them to further define them they can then be assessed.
- Process map your organisation. This is a more detailed process and involves identifying key processes within your organisation and then drawing flowcharts of them. You can then analyze every step in the process to identify the risks. This method is more systematic and leads to the discovery of interdepartmental risks. Ensure you also consider strategic risks as part of this process.

17. Categories of risk Financial risks Strategic risks Hazard risks
Internally driven
Externally driven
Strategic risks
Hazard risks
Financial risks
Operational risks
Exchange rate
Industry changes
Credit
Interest rate
Customer Need changes
Access to finance
Intellectual capital
Cash flow
R&D
Tough competition
Environment
Merge & Acquisition
Liquidity
Business interruption
Terrorism
Low motivation
Property damage
IT systems
Lack of skilled workforce
Natural Disasters
Loss of key players
Accounting controls
People risks
Supply chain
Legal/Compliance
Suppliers/outsourcers

18. Notes on risk identification
A business problem is not a risk
Risk should be describe specifically
context
event
consequence
However risk is identified within a company, it is important that what is identified is a risk and not a business problem and that it is specific enough for management to develop an effective response to. Otherwise you may find that you have a very effective plan mitigating the wrong risk.
For example, in Uganda at the moment the electricity companies have a business problem in that members of the public break into the mains electricity supply wires to steal electricity. As the wires carry a high voltage of electricity many of them get electrocuted and die. Electricity steal is not a risk. The risk coming out of this is that the family may sue the electricity company for compensation due to the loss of their loved one. There may be other risks such as power outages.
Risk definitions are often poorly expressed: Are risk definitions capable of being interpreted by anyone (with appropriate local knowledge) who picks up the risk register? Better risk definitions (context, event, consequence) are contrary to a lot of current thinking in risk management which has been to abbreviate risk descriptions to the smallest number of words possible – that really does not work.
Example: Fluctuations in USD FX rate is not a specific risk; Last year company took a loan of USD200,000 for 18 months. It is estimated that USD will rise by 5% this year. If this happen, the loan will cost us USD10,000 more.

19. Risk management process
Risk identification
Risk assessment
Risk response
Monitoring and Reporting
Evaluation
Once you have identified these risks, the next step is to assess them.

20. Likelihood High Likely to occur each year
More than 25% chance of occurrence
Medium
Likely to occur in a 10-year period
Less than 25% chance of occurrence
Low
Not likely to occur in a 10-year period
Less than 2% chance of occurrence
It is of no use looking at any risk in one dimension only; all risks must be evaluated in two dimensions. First, how often can it happen (the frequencies of occurrence) - LIKELIHOOD and secondly, how bad is it if it does happen (the impact).

21. Impact
Significant
Financial impact on the organization is likely to exceed $xx
Significant impact on the strategy or operational activities
Significant stakeholder concern
Moderate
Financial impact on the organization is between $xx and $xx
Moderate impact on the strategy or operational activities
Moderate stakeholder concern
Minor
Financial impact on the organization is likely to be less than $xx
Low impact on the strategy or operational activities
Low stakeholder concern

22. Risk-Assessment Matrix
From this simple risk profile you can then identify the top five or top ten risks and proceed to formulate your action plans on how to mitigate, control or optimise these risks to the benefit of your business.
The financial thresholds under impact as well as the frequencies of occurrence under likelihood may (and should) be adapted to the circumstances and context of the organisation. Each organisational unit must have a range of risks and likewise a range of priorities of addressing those risks.
For instance, it does not make sense to apply the same thresholds used at multinational level to a small operating unit.

23. Risk management process
Risk identification
Risk assessment
Risk response
Monitoring and Reporting
Evaluation

24. Risk responses Avoidance Reduction Transfer Acceptance
The Board and senior management usually a have a variety of options concerning their response to the risk that has been identified and analyzed.
These options typically include:
Avoidance: responses or measures that reduce the likelihood of occurrence
Reduction: responses or measures that reduce the negative impact and/or make best profit of the opportunities for positive impact of the occurrence.
Transfer: responses that transfer the risk e.g. insurance or outsourcing
Acceptance: responses that retain the risk
Risk response can also include the option of risk transfer is normally where you take out insurance for certain risks that you find too large to accept. It is important to discuss your risk profile and your business’ risk management culture with your insurance broker or underwriter so as to obtain the optimum insurance cover at the best price. If you practice good risk management principles within your business, you should be paying less in premiums than a comparable business with no risk management process.
USE EXAMPLES
e.g. Bomb Disposal
Protective clothing
Special equipment
Training
Procedures and processes for disarming the bomb
e.g. driving a car
defensive driving (Avoidance)
annual maintenance (Avoidance)
spare wheel (Mitigate - reducing the negative impact of a flat tire)
insurance cover (Transfer)
excess on insurance cover (Acceptance)
eg. fire in warehouse
avoid = no lighters or open flame or flammables in warehouse
reduce = sprinklers (water damage !!)
transfer = insure (get money to cover losses)
accept = some consumables/contents not covered

25. Risk responses Transfer Avoid Accept Mitigate
Once the risks have been plotted you can decide your course of action. "exposure“ to risk (combination of likelihood and impact) should determine the response of the organisation.
While the risks are in the ‘accept’ box you can scan, monitor and prioritise them. As they move from accept into avoid you can develop action/contingency plans.

26. Risk responses Equipment Clothing Training Policies and procedures
Disaster recovery plans
Crisis management plan
Business interruption plan
Others
Once an option of response has been selected, detailed responses should be developed. There are many ways to manage risks, for example: • Implementing policies that value employee safety over speed • Installing a security system to guard against property losses • Avoiding transactions with dubious potential customers • Training high potential managers on the roles and responsibilities of their superiors to protect against key person losses 26

27. Common mistakes in risk response planning
Not realizing that risk response planning can improve the value of project management
Spending too little time planning how to eliminate or deal with risks
Assuming that a plan will not be acceptable due to cost or other issues.
Proposing plans that are not realistic or far too costly for the company
Adopting sophisticated and complex responses when a simple solution will do

28. Notes on Selection of response
Be aware of negative consequences of responses
Avoid just adding new responses to existing ones; but conceive an optimal combination of responses.
The 4 steps - particularly the choice of type of response - should be conducted in line with the risk management approach and framework as approved by the Board and communicated to the whole organisation. This approach and framework should also clarify which types of response decisions are delegated to management and which type of responses should be communicated and/or approved by the Board.
Selection of response is a delicate and complex process
- Be aware of negative consequences of responses. Avoid responses which out way the impact of the risk on the organisation.
- Avoid just adding new responses to existing ones; but conceive an optimal combination of responses.

29. Risk management process
Risk identification
Risk assessment
Risk response
Monitoring and Reporting
Evaluation
It is important that the effectiveness of the response plans that have been put in place are monitored on a regular basis especially as we live in a continually changing environment.
The risk profile is a snapshot in time and many internal and external factors will influence your risk profile. You have to adjust your risk management strategies accordingly.
Therefore, you need a process to assess the large changes internal to your business and for the same reason, you also need to be cognizant of external changes and the effect those will have on your business.
If any internal of external change will affect the way you do business or, the way you planned to achieve your business goals, you need to re-assess your risks and re-plot your risk profile. Doing this will help you to effectively implement new action plans to mitigate and control to optimise those risks to your advantage.
Risk management plans should be reviewed and updated regularly. Taking a few days every six months with your financial adviser to review and update them for the current conditions of your business is a wise investment. This review meeting should also include the owners, department heads and (if warranted) a risk management consultant. Many times insurance companies – with an eye on reducing payouts on claims – provide hands-on advice on mitigating new risks as they come along. This is where your adviser will prove themselves. During the update period it would be a good time to reach out to them as well.

30. 4. Effective Risk-Monitoring and Reporting
Monitoring and reporting of Risk is usually carried out by management
A method(s) is developed for monitoring, testing whether all risks have been identified and that the response to the risk is effective
Reports are submitted to the Board on risks and risk response effectiveness
Red flags, ‘Traffic lights’ and heat maps are common
Process is on-going
To monitor the effectiveness of a particular response plan, you need to determine what measurements you can use. There may be more than one measurement. You will also have to develop the tools needed in the measurement. Tools can be developed such as questionnaires, management information systems, databases etc. Testing is important as part of monitoring. Where appropriate, response plans should be tested.
Reporting is usually done in a risk register. The complexity of the risk register will depend on your organisation. It is usual to have a detailed one for management and a summary for the Board.

31. Traffic Light escalation model
Green – Response Plan effective
Amber – Response Plan is new and effectiveness is still unsure or an existing response plan has issues
Red – Response plan has not yet been implemented or is not very effective.
A company can then use a traffic light escalation model to monitor and report on the risks paying particular attention to those High risks where the effectiveness of the response plan is still red.
Green – Response Plan effective
Amber – Response Plan is new and effectiveness is still unsure or an existing response plan has issues
Red – Response plan has not yet been implemented or is not very effective. There may be very good reasons for this for example cost of implementation. For example a printing company may require a back-up printing machine but it may be very expensive to acquire so they are accepting the risk but need to continually monitor so they know when the risk becomes too high and some action is required.

32. Risk management process
Risk identification
Risk assessment
Risk response
Monitoring and Reporting
Evaluation

33. 5. Evaluating Risk Management
Annually the risk management process should be evaluated by the Board to ensure:
Identified risks have not changed
Risk assessment has not changed
Risk responses are effective
Monitoring and reporting is effective
It is important for the Board to evaluate the steps taken by management to reduce risk in the company from time to time to ensure that the measures are effective and that the right risks are being managed. In smaller companies this would obviously be done by the Founder/Management but it is still important that time is taken to do this. Getting external advice on this part of the process is very useful.
As companies grow and perhaps new management is put in place it is important that this evaluation is not seen as a measure to keep control of what is going on. I have often heard CEO’s say that the Board is second guessing them or should probably be sitting on the knee of the CEO every day checking the decisions being made. This is not an effective process.

34. Board’s checklist Company’s appreciation of risk exposure is adequate
There are adequate plans for coping with risks
Board is informed of all material risk assessments

35. Reporting to Stakeholders
The company should report to stakeholders at least annually on risk
To engender trust in the brand and manage reputational risk companies will be required in this day and age to explain to certain key stakeholders how they are managing their risk. Often this will be done in a company’s annual report to shareholders. From time to time depending on the business it may be necessary to report to other stakeholders, customers, regulators, banks etc. on how a particular risk is being managed. In today’s social media society additional methods of communication are being used.

36. Risk Appetite/Tolerance
Risk appetite broadly defines the level of acceptable risk for an organisation
Risk tolerance defines the specific maximum acceptable risk for each risk category or specific risk.
Although both risk appetite and risk tolerance set boundaries of how much risk a company is willing to accept and are sometimes used interchangeably, they are not the same. Thus, while risk appetite broadly defines the level of acceptable risk, risk tolerance is a narrower concept that defines the specific maximum acceptable risk for each risk category or specific risk.
There was a failure to properly understand, define, articulate, communicate and monitor risk tolerances, with the mistaken assumption that everyone understands how much risk the organisation is willing to take.
Vulnerability is a function of probability – what are the odds that a particular risk will materialise and cost – and how much does your company stand to lose as a result. The goal of this step is to quantify which risks are worth worrying about and which ones aren’t. For the ones that are worth worrying about, the question becomes how affordable is it to protect your company against that risk. If a particular risk has a low probability of occurring and if it did it would cost your company a maximum of $50,000 in losses but it will cost $45,000 to protect against this risk, so it may not be a good use of resources to protect against it.

37. Risk Appetite/Tolerance
Your organisation to establish its risk appetite/tolerance
Set criteria based on likelihood and impact
Communicate risk appetite/tolerance within organisation
Ensure all polices and practices (specifically, those relating to remuneration) support behaviours consistent with your organisation’s risk appetite/tolerant
Companies should include in their annual report a statement which sets out the company’s general attitude towards risk, this should be consistent with the Company’s strategic objectives.
There is broad consensus for the view that a company’s risk appetite and tolerance to risk should be set by management, subject to rigourous review and approval by the Board.
A lesson from the global financial crisis is that the appetite for risk within an organisation can often be different at different levels within the organisation. The Board may be conservative in their risk appetite but management and employees can be very aggressive in their approach to risk. This is usually because of how the organisation remunerates its management and employees. They are paid to take risks.

38. Implementing risk management
Session 3
Implementing risk management

39. Session 3: Objectives Describe roles and responsibilities of board
Describe roles and responsibilities of management
Develop an action plan to set-up risk management system at your company.

40. Session 3: Content Steps to implement risk management
Board’s roles in set up risk management system
Management’s roles in set up risk management system

41. Steps to implement risk management
Have a clear strategy and policy
Create structure culture
Implement a plan
Measuring performance
Audit and review
Implementation of risk management in your business can be achieved through five easy steps. The basic principles are to build on processes, systems and data that you already have and just place a risk-focus on them. You may not require all the aspects mentioned under each step as your risk management framework must be relevant to your business requirements and must be aligned to the corporate culture within your business.
A clear strategy and policy
The risk management strategy must set a clear direction to follow for all employees. It must also cover all business areas and a clear commitment to continuous improvement must underpin the risk strategy.
In addition, it must be a cost effective approach; what is needed and relevant for your business in order to reduce and prevent financial losses.
Create structure culture
Put in place an effective management structure to deliver the policy. All employees should be motivated and empowered to evaluate the risks associated with their jobs and take risk-informed decisions. All employees should also be committed to protecting the long-term success of the company.
The risk management policy acts as a guideline for operations and a filter for decisions. Effective communication will ensure full employee involvement and participation and the sustained effective communication and promotion of competence will ensure success.
A positive risk management culture is fostered by the visible and active leadership of the owners and executives. Therefore, encourage all employees to freely share ideas and best practice.
 Implement a plan
Have a formal planned and systematic approach. Decide priorities and set objectives to mitigate, control or optimise risks, with regular assessments of controls in terms of their design and effectiveness, but guard against costly over-controls.
Effectively arrange for the transfer of risks (insurance) where applicable and establish the overall risk profile—have a consolidated view of the business, establishing performance indicators and key risk indicators as required.
Measuring performance
Set risk performance standards to measure against and introduce pro-active self monitoring of all internal and external risk factors. It is important to investigate why controls failed, which can be achieved through re-active monitoring and causal analysis.
Scrutinise internal and external risk events and their affect on the company’s risk profile and identify the underlying causes and the implications for the design and operation of the risk control system.
Audit and review
Use public information to do an external comparison with competitors and best practice – learning from all relevant experiences and events and then applying the lessons is paramount (it is better and cheaper to learn from the mistakes of others than from your own mistakes).
Also, revise policies, systems and techniques as your business grows and when external and internal factors force changes. Make a relevant risk disclosure in annual financial statements, whether required by regulation or not.
SMEs do not require complicated risk frameworks, detailed regulations or expensive software systems to drive real value from risk management; just the basics of risk management will go a long way in adding true value and building sustainable competitive advantage. The future of risk management and corporate survival lies in making every employee a risk manager

42. Board’s role
Establish and communicate a risk management strategy that set a clear direction to management
Ensure that appropriate risk management systems are in place
Eliminate policies that promote excessive risk-taking
Establish reward systems that align goals to long-term value creation and sustainability
Ensure that the Board is helpful to access risk profile.
Guide the organisation towards best practice in corporate governance which should support the long-term sustainability of the organisation and create value in the short, medium and long-term.
Ensure that appropriate risk management systems are in place to avoid excessive risk taking, including determining the risk appetite of the organisation and agreeing on the recommendation of management the risk tolerances.
Eliminate policies that promote excessive risk-taking for the sake of short – term value creation which compromises value in the medium and/or long term.
Establish reward systems that align goals to long-term value creation and sustainability of the organisation
Ensure that the Board is comprised of primarily independent, diverse members, which is helpful to access an organization’s risk profile.

43. Management’s roles Set the “tone at the top”
Establish and monitor processes and procedures for risk management and internal controls
Ensure risk processes and procedures are operated by competent personnel
Implement remuneration policies that encourages disciplined and transparent risk taking
Management’s role is primary for creating an environment in which a culture of performance with integrity can flourish. Management should:
Set the “tone at the top”, specifically with regards to risk management
Establish and monitor processes and procedures for risk management and internal controls
Ensure risk processes and procedures are operated by competent personnel
Implement remuneration policies that encourages disciplined and transparent risk taking

44. Risk Management
Risks are interrelated and need to be managed comprehensively and holistically
Everyone in an organisation should be responsible for risk
Risk Management should be embedded into the day to day operations and management of the business
Every company should designate someone with responsibility for risk

45. Contact Details
SME Management Solutions IFC Sustainable Business Advisory/Nigeria First Floor, Maersk House Plot 121 Louis Solomon Close, Victoria Island Lagos-Nigeria Tel: Fax:
Give the participants adequate time to write down the contact information.