The world of risk observed by Professor Jean-Paul Louisot, Université Paris 1 Panthéon Sorbonne, Dean of curriculum CARM_Institute The word risk has several meanings and can be misleading when used in a professional context, especially in the case of an organisation communicating on risks with a broader audience. Therefore, practitioners and academics in risk management need to define a more precise concept.

This is what George Head, creator of the Associate in Risk Management designation, attempted with the word “exposure” as early as 1975. However, in those days, only the downside of risks was included, hence a new definition more appropriate for today’s global approach:

“An exposure is characterised by the financial consequences resulting from the occurrence of an unexpected (random) event that modify the resources of an organisation”.

This definition allows for an exposure to be clearly identified with three factors.

Risk object: the resource “at risk” that the organisation needs to reach its goals and missions. We will identify next month in the same column the main classes of resources.

Random event: It is “what” may happen that would modify permanently or temporarily the level of the organisational resources resulting either in an opportunity (sudden increase in the level or quality of the resource) or a threat (sudden decrease in the level or quality of the resource). The likelihood of the event will lead to a measure of the “frequency”.

Potential impact (peril): Most organisations strive to quantify the financial impact of the exposure identified through the resources “at risk” and random events. However, all goals and objectives of a given organisation are not necessarily translated into financial terms; ethics and corporate social responsibilities must also be taken into account. However, one should keep in mind that the severity is nearly always measured in financial terms.

It should be noted that all consequences do not touch only the organisation under study; therefore, especially for the downside risk, it is essential to distinguish between primary damages – the impact on the organisation itself and its resources – and tertiary damages – the impacts on all third parties and the environment. Special attention should be given to impacts on the organisation’s partners (both downstream, customers or clients; upstream, suppliers or subcontractors; and temporary for special projects). The analysis should extend to all consequences and not be limited to liabilities as long term consequences with no immediate legal implication can prove costly, specifically for the organisation’s reputation. On the other hand, “tertiary damages” involving contractual, tort or penal liabilities will impact the organisation’s resources through its executives, employees, finances and even maybe its social licence to operate.

In a complete analysis, the upside risk should be included, as the threats to one organisation may well create an opportunity for another!

Once the concept of exposure is clearly mastered, it provides a model with which to develop a systematic approach to risk management as any organisation will be seen then as a portfolio of exposures, challenges to the optimal implementation of a strategy. The risk register suggested by the Australian standard appears as the list of the various “risk assets”. Therefore, the decision tools developed in finance for the management of investment portfolios – the portfolio theory – are pertinent to implementing a rational decision process in risk management, leading to sound governance.

Once again, the concept of exposure constitutes a step towards the integration of risk management in the conception and implementation of an organisation’s strategy, leveraging opportunities and mitigating threats as they materialise along its path to excellence.