UNIVERSITY
OF
SOUTH AFRICA
POST GRADUATE DIPLOMA: RISK
MANAGEMENT
ASSIGNMENT 04
STUDENT:
STUDENT NUMBER:
MODULE:
OPERATIONAL RISK MANAGEMENT
DUE DATE:
UNIQUE NO.:
1
INDEX
PAGE(S)
Question 1
3
Question 2
4
Question 3
5
Question 4
6-7
Question 5
7-8
Question 6
9
Bibliography
10
2
QUESTION 1
SECTION A
INCOME AND EXPENDITURE
INCOME
R
Income (Sales - CoS)
Other income
Gross Income
1
6 400 000
5 000 000
11 400 000
Calculations
1
R16 000 x 2 trucks = R32 000
R32 000 x 20 days/mth = R640 000
R640 000 x 10mths = R6 400 000
less : EXPENSES
Advertising
Staff Training
Insurance
Building Rent
Building Security
Fleet Maintenance
Interest on loan
Vehicle Maintenance
Staff Remuneration
2
3
4
5
6
7
8
9
-500 000
-455 000
-162 000
-240 000
-78 000
-624 000
-814 440
-85 000
-2 490 000
2
R65 000 x 7 staff = R455 000
3
[R5 500 x 2 trucks x 12mnths ] + [R2 500 x
12mnths]
4
R20 000/m x 12mths = R240 000
5
R6 500 x 12mnths =R78 000
6
R52 000 x 12mnths =R624 000
7
R67 870 x 12mnths = R814 440
8
10 000km x 2 trucks = 20 000km
20 000km x 10mths = 200 000km
200 000km / 20 000km service intervals =10
services
Net Profit before tax
5 951 560
R8 500 x 10 services = R85 000
9
Tax Liability
-3 192 000
R470 000 x 2 = R940 000
R350 000 x 2 = R700 000
R275 000 x 2 = R550 000
(11 400 000 x 28% = R1 792 000)
R300 000 x 1 = R300 000
Net Profit after tax
2 759 560
After calculating the income and expenditure for the first year of the business, a net
profit is made. Based on this it would appear that, from a financial perspective, it
would be worth the risk for Mr Baloyi to start the business. The monthly income
amount of R90 000 before tax, envisaged by him, is achieved and the annual
investment of
R1 million to grow and sustain the business can be done. It must
also be mentioned that according to the Generally Accepted Accounting Practice, the
R5 million loan amount would not be included in the income figure. When this is
done it reduces the income figure and results in a lower net profit before tax of
R951 560 (R5 951 560 – R5 000 000) and a net loss after tax of R840 440. [(R6,4m
x 28%) – R951 560]
3
After revising these figures to meet GAAP financial reporting standards it provides an
indication, that from a financial perspective, it will not be worth the risk for Mr. Baloyi
to pursue this business venture.
QUESTION 2
The four inherent operational risk factors for Mr Baloyi’s business is the following:
1. The availability of skilled and trained workers to operate the cement trucks.
Currently there is a shortage of these workers in South Africa. Should Mr. Baloyi
experience a staff shortage due to resignation, leave or death it will negatively
impact on the operations of his business. He can mitigate this risk factor through
either employing additional staff or by training existing employees to perform all
the operations of the business. In this way Mr Baloyi does not need to stop
operations should he experience staff shortages.
2. Availability of diesel fuel for the trucks to operate is another risk factor for Mr.
Baloyi to consider. Should the country experience a shortage of diesel, the trucks
will not be able to provide ready mixed cement to his clients. A possible mitigation
to consider is purchasing or leasing vehicles that uses petrol instead of diesel. He
could also consider outsourcing the cement delivery operations to another
business that are more assured of diesel fuel supply when shortages do occur.
3. Another risk factor is the availability of cement due to strike action within the
industry. Should a strike occur the availability of cement will stop, thus making it
impossible for Mr. Baloyi to provide cement to his clients. Strike action, particularly
protracted strikes, can have dire consequences for small to medium businesses.
To mitigate this Mr Baloyi, should consider alternative cement suppliers which are
not affected by local strike action. This could mean importing cement from
overseas based cement companies.
4. One last risk factor to consider, is the cement trucks being involved in road
accidents. These could range from small to potentially life threatening or ending
accidents. The consequences of these accidents could result in legal actions
which in turn results in high legal costs but also third party claims. Mr Baloyi
should consider obtaining insurance for the trucks that include 3rd party cover.
4
Furthermore he should appoint a legal firm to deal with legal matters related to the
business
operations.
5
QUESTION 3
3.1 & 3.2
INHERENT RISK
RATING
RISKS
Limited availability of
skilled and trained staff to
operate cement trucks
Impact
Likelihood
2
2
RESIDUAL
SEVERITY
Impact
Likelihood
4
Train existing employees to perform all
the operations of the business.
2
1
2
2
2
4
2
1
2
2
2
4
Purchasing or leasing vehicles that uses
petrol instead of diesel.
2
Non availability of cement
due to strike action
2
IMPACT RATING
CONTROLS
RESIDUAL RISK
RATING
Employ additional staff.
Limited availability of diesel
fuel
Trucks involved in road
accidents
INHERENT
SEVERITY
3
6
Outsourcing the cement delivery
operations.
3
6
Importing cement from overseas based
cement companies.
Obtain business insurance to include 3rd
party cover.
2
3
6
Appoint law firm to deal with business
legal matters.
LIKELIHOOD RATING
Score
Description
Score
Description
1
Low
1
Unlikely
2
Medium
2
Likely
3
High
3
Highly likely
6
QUESTION 4
HIGH IMPACT /LOW
LIKELIHOOD
HIGH IMPACT / HIGH
LIKELIHOOD
Possible Decision:
Risk to be tracked closely and
ensure efforts are made to
mitigate it.
Possible Decision:
Risk likelihood to be verified
and immediate mitigation to be
done.
Risks
Limited availability of diesel
fuel.
I
M
P
A
C
T
Non availability of cement due
to strike action.
Trucks involved in road
accidents
LOW LIKELIHOOD / LOW
IMPACT
LOW IMPACT / HIGH
LIKELIHOOD
Possible Decision:
Risk to be monitored and no
action to be taken.
Possible Decision:
Risk to be monitored and
mitigation to be considered
Risks
Limited availability of skilled
and trained staff to operate
cement trucks
LIKELIHOOD
Diagram 1: Four quadrants risk map
4.1
Based on diagram 1, when a risk has a high impact and high likelihood
management will usually verify the likelihood of the risk and implement
mitigations in order to reduce or eliminate the businesses exposure to this
risk.
When a risk has a high impact but a low likelihood of occurring,
management may track the risk and ensure that efforts are made to mitigate
the risk.
When a risk has a low impact and a high likelihood of occurring,
management may decide to monitor the risk and consider whether mitigations
should be implemented.
When a risk has a low impact and a low likelihood of occurring,
management would normally monitor the risk and take no further action to
mitigate it.
7
4.2
The risks identified have been plotted in the four quadrants risk map diagram.
Risks such as trucks being involved in road accidents, the limited
availability of diesel fuel and the non-availability of cement due to strike
is considered to have a high impact on the operations of the business and
a high likelihood of occurring. The core function of the business is to provide
cement to clients using its trucks. If the trucks is not operational due to a
shortage of diesel and /or no cement is available to deliver, the business will
be negatively impacted. Furthermore should trucks also be involved in
accidents and rendered inoperative, this also has dire consequences for the
business.
The risk of limited availability of skilled and trained staff to operate the
trucks is considered to have a low impact on the business but it is highly
likely to occur. Although the skilled staff is required to operate the trucks it
should have a low impact on business operations as other people in the
business can be trained to take over operating the truck should there be a
shortage of staff.
QUESTION 5
SECTION B
An integral part of any risk management methodology / framework is risk reporting
and there are benefits for both internal and external stakeholders that can be
derived. For external stakeholders’ e.g. potential investors, it provides insight into
how a business manages risk to ensure growth for its shareholders. For internal
stakeholders it assists in making decisions around risk exposure, the management
thereof but also opportunities that can be explored to further expand the business. A
risk methodology also provides a standardised approach to managing risk within a
business and leads to risk information in terms of risk indicators, risk and control
assessments and risk events. By including the aforementioned risk information in
risk reports it assists management to make informed decisions around dealing with
high risk areas within a business. A caveat to this is that risk information should be
presented in a manner that is clear and concise but most importantly, lead to action.
8
It is therefore important to understand generally what principles can be used to
enhance risk reporting.
Risk reports would generally contain numbers, values or figures. It is vital that these
values be explained in the report as it provides context to the reader. E.g. A risk
rating table contains numbers which is used to rate risks. Each number has a
description to explain what the number means or represents.
Although the risk report contains numbers it must translate into actions. Therefore
risk reports should clearly indicate when action should be taken and by whom. E.g. is
the risk severity matrix. This matrix contains threshold values that indicates what
actions must be taken and by whom when a risk reaches a particular threshold.
For risk reporting to be effective it needs to be reported timeously to the respective
target audience. There are no strict guidelines as to when risk reporting should be
done and it would be dependent on the needs of the business. E.g. Executive
management of Government departments report on risk management on a quarterly
basis to
Audit Committees,
however
managers within
these
government
departments report monthly on risk to executive management.
As previously mentioned, action is required to mitigate risk. This action must be
allocated to someone to execute. In doing this ownership for the management of risk
is done and this should be included on the risk report. The report should indicate
what does risk ownership mean and what responsibilities are attached thereto. E.g.
A risk register would contain a heading or column for a risk owner. When the register
is reviewed the relevant risk owner would be required to give feedback in terms of
actions taken relating to a particular risk.
The risk report should clearly explain where are areas on non-compliance within the
business that could raise its risk profile. The report should therefore provide methods
that it will follow to ensure that this does not happen. E.g. when purchases are made
but it’s not in terms of the businesses current procurement policy.
It is also essential that when reporting on risk, that risks which the business deems
relevant for its purposes, be included in the risk report. This allows management to
have a more focussed approach on managing the risks of the business.
9
Question 6
Setting a risk appetite for a business can be cumbersome and therefore top
management’s role and responsibility in doing so is important.
Top management role in setting a realistic risk appetite requires them to understand
the objectives of the business. This will help management to understand where the
business is headed and what it wants to achieve. If available, top management
should also make use of risk information e.g. risk and control assessments, key
indicators. This will assist them in understanding what risks the business faced
previously and to what level current risks are being mitigated. Financial information
e.g. management reports, financial statements should also be considered as this will
provide an indication of the financial state the business is in. It must also be
mentioned that these are not the only sources management can utilise to set a risk
appetite.
When setting the appetite top management must ensure that it is aligned with the
objectives of the business and that the statement is clear and not ambiguous. Top
management should also provide clear guidelines and definitions to avoid situations
where the risk appetite cannot be misinterpreted. When the risk appetite is set, top
management is responsible for ensuring that risk appetite is approved by the Board
of Directors and it should communicate the risk appetite to all staff within the
business. This should serve as a reference point that will govern activities taken by
them while executing their duties in the business.
10
BIBLIOGRAPHY
Blunden, T. and Thirlwell, J., 2013. Mastering Operational Risk. 2nd ed. United
Kingdom: FT Publishing.
Kaiser, T. (2006). An introduction to operational risk: a practitioner guide. London:
Risk Books
Graham, A., 2008. Integrated Risk Management: Implementation guide. 1st ed.
Australia, viewed 19 September 2020,
http://www.andrewbgraham.ca/uploads/1/2/5/1/12517834/textpdf.pdf
Valsamakis, A., Vivian, R. and Du Toit, G., 2003. Risk Management. 2nd ed.
Sandton: Heinemann Higher and Further Education (Pty) Ltd.
Service, CL., 2015. Gripping GAAP. 16th ed. Durban: LexisNexis
Reuvid, J. (ed.) (2007). Managing business risk: a practical guide to protecting your
business. 4th ed. London: Kogan Page
11