Risk management decision criteria

There are four main reasons why people and organisations apply risk management, namely:

• Cost benefit.
• Risk aversion.
• Authoritative reasons.
• Policy based decisions.

As said earlier, the biggest reason for applying risk management is due to the financial benefits.  

The basic philosophy is that money should only be spent if the benefits outweigh the expenditure. In this context, the capital spent on installing a sprinkler system is seen as an investment and it must produce a return. The return on investment must be positive and preferably greater than the value usually gained; otherwise, the sprinkler should not be installed.  

To be able to calculate a cost-benefit analysis, risk analysis plays a critical role – as the comparison is basically between the risk involved vs. the money to be spent in order to reduce the risk to an acceptable level.  

Although important, it quite often happens that risk management is applied even though it is not cost-effective, due to one or more of the reasons below.

Another major reason why people and organisations apply risk management is because man is averse to risk.  Even people who regard themselves as risk-takers are in fact, averse to risk.

A banker who operates in the private sector would regard himself as a risk-taker. He is not actually a risk-taker. Before lending money, he will take every possible step to ensure that he has adequate security for the loan.

Because of this natural aversion, people take steps to reduce risks, even if the steps are not cost effective.  Imagine trying to convince the shareholders after a R50m fire loss that you had decided not to purchase a sprinkler system because you regarded it as being not cost effective.  After a major loss, no one is particularly interested in cost to benefit calculations.  

The decision to implement risk control measures – based on risk aversion – is influenced by the magnitude of potential losses and the cost of the control measures. The following usually influences the decision:

• The magnitude of the possible loss.
• The size of the capital investment in relation to the risk control expenditure.
• The magnitude of the maintenance budget in relation to the risk control expenditure.

Authoritative reasons play a major role in the decision for the implementation of risk control measures.  Together with aversion to risk, not many managers will argue about implementing a control measure if he knows that failure to do so could result in a jail sentence or being charged with culpable homicide if an employee is killed due to his failure to comply with legislation.  

The most common forms of authoritative reasons are: 

• Legislation, and
• Acceptable codes of practice. 

Another ‘form’ of an authoritative reason is society or the community.  Few people realise the power that society has, and that society can and will close an organisation down if the organisation is not seen to be responsible enough.

In practice, many decisions are simply policy-based decisions and linked to the company’s value system.  If the company’s policy is that its employees are important, it will probably have an effective system for prevention and treatment of occupational injuries and illness in the workplace. 

Another company may decide that they want to obtain ISO 9000 certification in order to enhance the quality and image of their product and would therefore develop and implement a quality assurance system.  It often happens that chemical companies for example, want to improve their image with the general public and would spend large amounts of money on environmental issues.  Although the original motivation may not have been specific to risk management, risk management would benefit.