Chapter 3: Implement risk management strategy

Risk management is a critical function within business management, especially in Kenya's dynamic economic environment where enterprises face diverse internal and external uncertainties. Implementing an effective risk management strategy enables organizations to identify, assess, and address risks that could undermine their objectives. This chapter explores the frameworks that guide risk management approaches, focusing on how businesses can choose appropriate strategies such as risk acceptance, avoidance, and transfer. Understanding these concepts equips managers to protect their organizations while optimizing operational resilience.

3.1 Risk management framework

A risk management framework is the structured approach a business uses to decide what to do about each risk it has identified and assessed. Without it, risks are handled in an ad hoc way: one manager ignores a serious risk while another spends heavily on a minor one. The framework links the risk register of the business to a set of possible responses, a plan for carrying them out and regular reports on progress. This topic covers five responses (acceptance, avoidance, transfer, limitation and exploitation), then the mitigation plan and the risk reports. How each response is chosen for a particular risk is covered under Developing risk responses.

Choosing a response

The choice of response depends on how likely the risk is, how large the loss could be, what it costs to control, and how much risk the owner is willing to carry. A retail shop, for example, may accept the risk of a few damaged items each month, avoid selling a product that cannot be stored safely, transfer the risk of fire by buying insurance, and limit the risk of theft by training staff and fitting a lock-up cage.

3.1.1 Risk acceptance/retention

Risk acceptance, also called risk retention, is a deliberate decision to bear the consequences of a risk instead of avoiding, transferring or reducing it. It is chosen when the possible loss is small or the cost of controlling the risk is higher than the loss itself. For example, a small hardware shop may accept the risk of a few lost nails and screws in loose stock, because the cost of a weighing system would be more than the value of the loss.

Definition of risk acceptance

Risk acceptance means that the business knows the risk exists and chooses to tolerate it without special control measures. The decision is based on a comparison of costs and benefits and is recorded in the risk register with the name of the person who approved it, so that it is a decision and not simply neglect.

Criteria for choosing risk acceptance

• Low likelihood: A risk that is very unlikely to happen may be accepted so that money is not spent on controls that will probably never be used.
• Minor impact: A risk whose worst result is small enough to be absorbed from normal income can be retained.
• Cost of control above loss: When it costs more to reduce the risk than the expected loss, acceptance is the sensible choice.
• Strategic fit: Some risks come with an opportunity, such as trying a new product, and are accepted as part of growth.
• Contingency plans in place: A business with funds set aside and a recovery plan can accept a risk knowing it can respond if it happens.

Advantages of risk acceptance

• Cost saving: The business does not pay for controls that give little benefit.
• Simple management: There are fewer procedures to run and check.
• Awareness of risk: The risk is named and watched, not denied.
• Flexibility: Money and staff time are kept for the risks that matter most.
• Support for enterprise: New ventures always involve some uncertainty, and acceptance makes them possible.

Disadvantages of risk acceptance

• Unexpected losses: If the risk happens, the business meets the whole cost.
• Complacency: A habit of accepting risks may cause the business to overlook new threats.
• Concern among lenders and partners: Outsiders may doubt the prudence of a business that carries large risks.
• No active control: Nothing reduces the chance or the effect of the risk.
• Need for reserves: The business must hold enough cash to pay for the loss when it comes.

Application in business

A wholesale distributor of foodstuffs may accept the risk of minor delays in deliveries from a supplier when the goods are not urgent. A farm produce trader may accept the normal day-to-day changes in the buying price of vegetables and protect itself instead by selling more than one product.

3.1.2 Risk avoidance

Risk avoidance is the decision to stop or not to start an activity that creates a risk the business is not willing to carry. It removes the exposure completely, but it also gives up whatever the activity would have earned. It is appropriate when the possible loss is severe and an alternative exists. For example, a furniture manufacturer may decide not to buy timber from a supplier with no proof of origin, to avoid the risk of seizure or legal action.

Concept and rationale for risk avoidance

Avoidance means refusing to take part in activities that produce an unacceptable risk. The reason is to protect the business from harm where the likelihood or impact of a risk is too high to justify any possible gain.

Common risk types targeted for avoidance

• Legal and regulatory risks: Practices that break the law, such as failing to pay taxes or to follow labour rules, are avoided entirely.
• Financial risks: Speculative buying with borrowed money that could stop the business from paying its bills.
• Operational risks: Processes that often fail or cause accidents are stopped and replaced.
• Reputational risks: Partnerships or advertising that could damage the name of the business are declined.
• Environmental risks: Activities that pollute or harm the environment and could attract penalties from regulators are not undertaken.

Methods of implementing risk avoidance

• Policy development: Written rules state what the business will not do.
• Process redesign: A work process is changed to remove the dangerous step.
• Market selection: The business operates only in areas or sectors where the risk is acceptable.
• Contractual exclusions: The business refuses contract terms that give it unlimited liability.
• Training and awareness: Staff are told which risks are to be avoided and why.

Challenges of risk avoidance

• Opportunity cost: Avoiding a risk may mean losing a profitable activity.
• Cost of change: Stopping or replacing an activity may need new equipment or staff.
• Risk cannot always be removed: Some risks are part of doing business and can only be reduced.
• Resistance: Staff may resist changes to the way they work.
• Hidden risks: A risk that has not been identified cannot be avoided.

Examples from business

A transport and courier business may avoid carrying goods that it has no insurance for, such as cash or unpackaged fragile items. A restaurant supplier may avoid buying meat from unlicensed sellers, to prevent health and legal risks.

3.1.3 Risk transfer

Risk transfer means passing the financial consequences of a risk, or the responsibility for managing it, to another party, usually by insurance or by a contract. In insurance, an underwriter, which is the business that issues the policy, agrees to pay for the loss in return for a premium. The risk is not removed: someone else agrees to bear it, normally for a price. Many businesses use it for risks that could cause a loss large enough to threaten their survival.

Definition and mechanisms of risk transfer

Risk transfer moves ownership of a risk to a party better able to manage or absorb it. The main mechanisms are insurance policies, contracts that place responsibility on another party (such as indemnity clauses and performance bonds), and outsourcing of specialised activities.

Types of risks commonly transferred

• Property risks: Fire, theft and damage to buildings, stock and equipment are transferred by insurance.
• Goods in transit: A business that sends goods by road may insure the load against loss or damage on the way.
• Liability risks: A contract may require a supplier or contractor to pay for harm it causes to customers or to others.
• Financial risks: A business that sells on credit may pass collection of debts to an agent, and one that imports may fix an exchange rate in advance with a forward contract.
• Employee-related risks: Under the Work Injury Benefits Act, 2007, employers must insure their liability for work injury compensation to their staff through a policy with an approved insurer.

Benefits of risk transfer

• Financial protection: A large loss falls on the underwriter or contractor, not on the business.
• Use of expertise: Specialists such as underwriters and security firms manage the risk.
• Stable cash flow: Regular premiums replace the chance of a large unplanned payment.
• Compliance: Some insurance is required by law or by lenders and landlords.
• Focus on core activities: Management time goes into the main business.

Limitations and considerations

• Cost: Premiums and fees reduce profit.
• Incomplete cover: Policies have exclusions and limits, so some losses are not paid in full.
• Moral hazard: A business that feels fully protected may take less care.
• Disputes: Unclear wording in a contract or policy can lead to arguments about who must pay.
• Dependence on others: The business relies on the underwriter or contractor being able to pay.

Application in business

A retailer commonly insures its stock against fire and burglary. A business that hires a contractor to build a warehouse may require the contractor to provide a performance bond, so that it is repaid if the work is not completed.

3.1.4 Risk limitation/modify impact and likelihood

Risk limitation, also called risk reduction, means taking action so that a risk becomes less likely, or its effect smaller if it happens, or both. It is a response often used for risks that are too large to accept and cannot be avoided or fully transferred. Controls that lower the likelihood are preventive, and controls that lower the impact are protective. For example, a bakery wholesaler may lower the likelihood of a delivery van breaking down by servicing it on schedule, and lower the impact by having a second van that can be hired at short notice.

Reducing likelihood

• Training: Staff who know the correct procedure make fewer errors.
• Maintenance: Servicing vehicles, machines and buildings on schedule prevents breakdowns.
• Separation of duties: Having one person order goods and another pay for them makes fraud less likely.
• Supplier checks: Choosing suppliers with a record of reliable delivery lowers the chance of shortages.
• Access control: Locks, registers and signing-in rules reduce theft.

Reducing impact

• Back-ups: Copies of sales and customer records stored in another place limit the damage of loss or computer failure.
• Fire and safety equipment: Extinguishers, alarms and clear exits limit the damage of a fire.
• Spreading exposure: Buying from more than one supplier, or selling to many customers, means that one failure does not stop the business.
• Stock limits: Keeping goods in two stores means a fire or burglary in one does not destroy everything.
• Contingency plans: A written plan states who does what when the risk happens.

Measuring the effect of limitation

The benefit of a control can be shown by rating the risk before and after it. Scoring likelihood and impact from 1 to 5 as on a risk assessment matrix, a stockroom with a likelihood score of 4 and an impact score of 3 has a risk score of 4 × 3 = 12. After a lock-up cage and a daily stock check lower the likelihood to 2, the score is 2 × 3 = 6. The remaining risk after controls is the residual risk, which management must then judge acceptable or not.

3.1.5 Exploitation

Exploitation is the response used for a positive risk, which is an uncertain event that would benefit the business if it happened. Instead of avoiding or reducing it, the business acts to make sure the opportunity is realised. It is the opposite of avoidance: avoidance removes a threat, and exploitation secures a gain. For example, a retailer learns that a large customer wants a regular supply of a product it already stocks, and it arranges extra storage and delivery capacity to make sure it wins the contract.

When exploitation is used

• A clear opportunity: An event such as a new customer, a new market or a supplier discount would raise income.
• Capacity available: The business has, or can quickly obtain, the money, stock and staff to take advantage.
• Short window: The chance may be lost if the business waits.
• Fit with objectives: The gain is consistent with the goals of the business.
• Acceptable cost: The cost of taking the opportunity is lower than the expected benefit.

Ways of exploiting an opportunity

• Assigning the best resources: Putting the strongest staff and equipment on the opportunity.
• Giving it management priority: Decisions are made quickly and delays removed.
• Acting early: Applying, ordering or bidding before competitors.
• Training and preparing: Making sure staff can deliver once the opportunity arrives.
• Investing: Spending on stock or equipment to be ready for increased demand.

Cautions

An opportunity also brings risk of its own, such as overstretched staff or unpaid credit sales. Exploitation therefore goes together with a check that the business can deliver and be paid, and the result is recorded in the risk register like any other response.

3.1.6 Risk mitigation plan

A risk mitigation plan is the written document that sets out, for each risk that needs action, the response chosen, the steps that will be taken, who is responsible, what they will cost and when they must be done. It turns the decisions of the framework into work that people can carry out and check. The detail of preparing an action plan is covered under Mitigation action plan in the risk assessment chapter of this unit; here the plan is treated as the link between the response chosen and the reports that follow.

Contents of a mitigation plan

• Risk and its rating: The risk is named, with its likelihood, impact and score.
• Response chosen: Whether it is to be accepted, avoided, transferred, limited or exploited.
• Actions: The specific steps to be taken, such as installing a lock-up cage or buying insurance.
• Owner: The person responsible for each action.
• Resources and cost: Money, equipment and staff time needed, and the approved budget.
• Timeline: Start and completion dates for each action.
• Trigger and contingency: What event shows that the risk is happening, and the backup action to take then.
• Monitoring: How and when the action will be checked.

Example of a plan entry

Using the plan

The plan is approved by the owner or manager, shared with the people who carry out its actions and reviewed regularly. Actions not done on time are reported and either completed or changed, so that the plan stays a working tool and not a document in a drawer.

3.1.7 Risk reports

A risk report is a written summary that tells management and the owners of the business what the main risks are, how they are changing and what has been done about them. It allows decisions to be made on facts and shows whether the mitigation plan is working. A short report that is produced regularly is more useful than a long one that is written once.

Purpose of risk reports

• Informing decisions: Managers see which risks need money, attention or a change of response.
• Tracking progress: The report shows which actions are complete and which are late.
• Accountability: The people responsible for risks and actions are named.
• Early warning: New and growing risks are spotted before they cause loss.
• Evidence for outsiders: Underwriters, lenders and auditors may ask to see how risks are managed.

Contents of a risk report

• Summary: The overall risk position in a few sentences.
• Top risks: The risks with the highest scores, with their trend since the last report.
• Incidents: Losses and near misses since the last report, with their causes.
• Progress on actions: What has been done, what is late and why.
• New risks: Any risk added to the register, with its first rating.
• Recommendations: Decisions needed from management.

Types of risk reports

• Periodic reports: Prepared monthly or quarterly for managers.
• Incident reports: Prepared at once after a loss or a serious near miss.
• Annual reports: A full review of the year for the owners.
• Exception reports: Sent immediately when a risk goes above a set level.

Preparing a good risk report

1. Collect data: Take the figures from the risk register, incident records and action logs.
2. Check accuracy: Confirm the figures with the people responsible for them.
3. Select what matters: Include the main risks and decisions, not every item in the register.
4. Present clearly: Use short sentences, a table of top risks and simple colours or ratings.
5. Name decisions: End with the actions the reader is asked to approve.
6. Distribute and file: Send the report on time to the right readers and keep a copy.

Chapter Summary

This chapter focused on the implementation of a risk management strategy by first exploring the risk management framework which includes key approaches such as risk acceptance or retention, risk avoidance, risk transfer, risk limitation to modify impact and likelihood, and exploitation of opportunities. It highlighted the importance of developing a comprehensive risk mitigation plan that outlines specific actions to address identified risks and the role of risk reports in communicating risk status and progress. The chapter then detailed the process of developing effective risk responses tailored to the nature and severity of risks faced by an organization. Finally, it examined how to evaluate risk results and use lessons learned to drive continuous improvements in risk management practices, ensuring that organizations remain resilient and adaptive in dynamic business environments.