Risk Management in Medium-Sized Housing Associations - Essay Example

Risk Assessment and Management in Medium Sized Housing Associations Risk is all pervasive and omnipresent in every occupation. It is of even higher extent in business sector especially in Small and Medium Sized Enterprises (SMEs). Risk assessment and management profoundly highlights the fact that the existence of business entity purely depends upon its ability to foresee and prepare for change instead of waiting for the change to occur and then respond to it. It must be borne that the objective of a business entity is not to prohibit or avoid risk, but to assure that risks are being taken with clear understanding and complete knowledge so that it can be quantified to support mitigation. Understanding Risks Risk is often seen as possibility of an undesirable event. Under scenario analysis, risk is differentiated from threat. A threat is considered an event with very low probability but possessing serious harms. Analysts are often unable to allocate a probability to threat and for that there is no effective preventive measure is available. The only precautionary measure that can be taken to cope up with a threat is to reduce the set of definite risks before proceeding to an experiment, project, action or innovation. A risk is usually defined as a function of three variables. They are: 1. The possible impact 2. The possibility that a threat is present 3. The possibility that vulnerabilities are present If any of the above-mentioned variables reduces to zero, then the overall approaches to risk will be zero. For instance, humans are extremely vulnerable to the threat that aliens might control their minds, which would have a severe effect. But since we have never seen aliens therefore, we can say that they might not pose such amount of threat so the overall risk reduces to almost zero. Risks associated with SMEs Every type of business possesses some level of risk. Many risk-averse people prefer not to do business, since it includes a large amount of risk i.e. a business might work, and a business might not work. So there are 50/50 chances that one will be successful in respective business. Every business has certain risks, some of which are foreseeable while others cannot be predicted and are therefore uncontrollable risks. Risk is an important component of small and medium sized business as well. Some common types of losses in SMEs include fire, theft, flood, injury, legal liability, disability, etc. Undoubtedly, every business entity requires vigorous risk assessment and management system but Small and Medium Sized Enterprises (SMEs) need to put even more attention to risk management since they may not have means and resources to control and manage risks due to several limitations and their varying size. However, this is not the case in large multinational corporations because organizations take special measures to cope up with the aspects pertaining to risk. All aspects of risks must operate within agreed limits, procedures and controls. SMEs do not comprise of any specific type of organizations, they may include proprietor concerns, partnership firms or unlisted companies. In SMEs, gut feeling which is subjective in nature is usually relied upon as compared to multinational corporations, which rely upon pure analysis that are primarily objective-oriented. Risks in Small and Medium-sized Housing Associations Just like every other business, small and medium sized housing associations are also burdened with the threat of risks. Housing associations have been badly hurt by the financial crisis of 2007-08. It resulted in reducing capacity of housing associations to invest in new constructions (Lloyd, 2008). Housing associations have become vulnerable financially. These crises have bombarded large number of risks to the housing sector. The fact that no property was being sold, it put the housing associations under severe pressure and made things very difficult for entire housing sector. A large number of residents were on low incomes which were adversely affected by the faltering economy (Forrest and Yip, 2011). The regulatory body of housing associations expects every housing association to function within a framework which efficiently determines and manages risks. The assessment of risks also applies the housing association enters into an agreement or a contract with support provider or managing agent. Housing associations should complete an extensive study for identifying probable risks in the individual organization. Housing associations need to ensure that such organizations will survive in business for the foreseeable future. They must also develop proper monitoring systems in order to reduce the level of risks. There must be a low level of risk in some arrangements, especially non-contractual settlements. Risk assessment must be apportioned depending upon the nature of agreement (Housing Corporation, 2006). Small and medium sized organizations usually have less managerial time and other necessary resources to offer to formal risk assessment. Careful assessment of the important constituents is required which are absolute vital for decent practices and to comply with rules and regulations. Small and medium sized organizations have specific vulnerabilities and require a modified approach. SMEs have limited resources therefore it is very important to utilize the resource cost effectively. This usually means to focus on those areas which carry highest level of risks (Housing Corporation, 2006). Though it might seem apparent, it has essential implications. Namely, there must be no compromise on the quality of identification and assessment of risk. The risky areas must be established clearly in order to ensure that majority of efforts is directed to those areas which are highly risky. Since reality is way different than planning, therefore if any compromise is made then they must be in complete knowledge of the potential implications and must be absolutely transparent and open. For instance, in reality one person must check the work of another person. If it is unrealistic, then it must be openly recognized as an addition in the level of risk. This approach may help to address many internal control issues with which SMEs are usually wrestling (Housing Corporation, 2006). According to paragraph 2.8 of Regulatory Code: a) “The association’s risk management framework highlights key risks and how they are to be managed; b) The governing body regularly reviews activities and policies and all new business decisions and there is a clear case for the proposed or existing direction of the association; c) Approved terms of reference for the governing body and other committees and delegated authorities for staff are in place; d) There are internal control systems. Their effectiveness is regularly reviewed by the governing body and reported in the annual report.” (Housing Corporation, 2006) Paragraph 2.8 of regulatory Code further states that; “2.8.1 Identifying all major risks that might prevent them from achieving their objectives; 2.8.2 with the necessary arrangements to manage risks and mitigate their effects” (Housing Corporation, 2006) It can be clearly seen that the main emphasis of Housing Association’s Regulatory Code is to identify manage major risks. It is highly important to determine the areas with largest risks and to ensure that surveillance is applying control in order to manage those risky areas. Risk Practices in SMEs In order to determine risk practices in SMEs, a small survey was conducted. Under this survey, some smaller associations, i.e. around 1,000 entities, were given a questionnaire. This questionnaire was then followed by an interview of the firm’s executives, possessing the core responsibility of risk (Housing Corporation, 2006). Following areas were covered in the survey. Accountability for receiving and collecting information related to risks Utilization of third party as facilitator The risk register, having listed the sample of association’s risks How impact/probability is measured and how the risks are ranked Annual financial reporting in sample reports and risks, periodic board Explanation of current framework of risk management (Housing Corporation, 2006) Findings of the survey revealed following good practices; Most companies had the risk registers listing all the relevant risks, though not all of them had prioritized and assess those risks. Board of most of the SMEs approved and reviewed the risk register Some associations had documents of risky policies (Housing Corporation, 2006). Common Areas to improve Though most of the associations had detailed risk registers, very few of them measured the impact of risks and probability. Those that did, even fewer of them visibly ranked the risks in their risk registers. Many firms had long list of risks i.e. 40 to 50 risks with slight indication of how substantial they were considered. It makes it very problematic to make sure that appropriate attention is being given to those areas which need them the most (Housing Corporation, 2006). A common mistake that was found among associations was that they had listed too many risks on the register, which makes it costly and cumbersome to keep it up to date. Having too many risks listed in register can be counter-productive. It is very important to evaluate the probability or risks as well as their consequences and then must rank them in order of significance. Large number of firms did not isolate the highest risks and did not list then in order of significance. It was also observed that not all board approve and review the risk registers (Housing Corporation, 2006). RISK IDENTIFICATION AND EVALUATION This section of the paper sets out a basic guideline about how to determine and evaluate risk practically within small and medium sized enterprises. Types of Risks It is usually useful to categorize the kinds of risks that are faced by SMEs. The following scheme is a way of illustrating the kind of framework with the help of which the course of identification may proceed (Housing Corporation, 2006). Risk Area Examples Financial Risks Interest rate risk (resulting from fluctuation in interest rates), Liquidity risks (lack of ability of a firm to fulfill its financial commitments as they fall due), Bankruptcy risk (due to inability of paying off financial dues, risk of bankruptcy may arise), Working Capital risks (lack of working capital may become an obstacle in performing day to day activities of the firm) (Housing Corporation, 2006) Operational Risks Mistakes in data processing Multiple failures in projects (late delivery, mis-specifications, excessive cost) Poor value in procurement Fraud Breach of compliance or regulations Legal risks (misinterpretation of law, unenforceable agreements or contracts) Failure to control cost Failure to provide standard services as promised (repaired in emergencies etc.) Outsourcing risks (can be related to internal audit, IT maintenance etc.) (Housing Corporation, 2006) Physical Risks Natural threats to housing properties and office accommodation e.g. flood, fire, storms, resulting in loss of IT, buildings, phones and other integral facilities (Housing Corporation, 2006) Strategic Risks Worsening of economic environment Changes in policies of Government Changes in regulations Increased rivalry (Housing Corporation, 2006) Personal Risks Stress related to workplace Responsibility of directors Physical protection of front line workers (Housing Corporation, 2006) Reputational Risks Adverse publicity or poor service quality or of one off events of association’s development (Housing Corporation, 2006) Risk identification involves knowledgeable people about the concerned operations, who consider the possible downside scenarios and group them into categories accordingly. There are various possible approaches to risk identification and evaluation (Housing Corporation, 2006). Workshop: people who possess the knowledge of activities of associations meet for a workshop session. They are normally facilitated and directed by professional facilitator, who is independent of the matter of workshop. It is essential to ensure that facilitation is productive and right people participate in it (Housing Corporation, 2006). Questionnaire: questionnaires are designed especially for those people who possess understanding and knowledge of the key process of business. These questionnaires require thoughtful evaluation, format and design (Housing Corporation, 2006). Interview: a panel interview is usually taken of managers and other executives to obtain the list of risks and their assessment (Housing Corporation, 2006). All of the above-mentioned three approaches have their own pros and cons, whichever approach is employed; the results are subjected and documented to critical examination, most probably by a third party for instance internal audit, so as to certify them (Housing Corporation, 2006). RECORDING AND REVIEWING RISKS Recording and reviewing stage of the risks comes after identification such that it becomes the duty of the board to ensure the appropriate documentation of the results and then their evaluations (Housing Corporation, 2006). Risk register is the official document used in this regard which contain following types of information such as: Identification of the title of the risk The scores of probability/impact of the risks such that the risks are aligned in the register according to the ascending or descending order of the scores which shows the relative importance of the risks identified. Management of the risks which is in fact the combination of the responses collected and applied to the risks previously identified. Summary of course of actions is highly required in order to mitigate the risks to an acceptably low level. Course of actions must be allocated with the deadlines along with the identification of relevant people having the responsibility of implementing such course of actions. Risk movements i.e. assessment of the risks with the levels reported earlier. The risk registers and other relevant risks documentations require updating and reviewing on regular and frequent basis such as on monthly or quarterly basis. However, the review becomes necessary in events when there is a substantial change implemented in the operations of the housing associations. For instance: New projects are commenced New activities are started Significant structural changes or reorganization of association Implementation of new IT system etc. HOUSING ORGANIZATION’S RESPONSES TO RISKS Mere identification and assessment of the risks cannot standalone mitigate the risks of the housing associations. Housing associations need to make responses to those risks in pursuit of minimizing the level of risks to an acceptable level. The responses to the risks can be specific to a certain risk or there can be an overall response to all risks in the form of collective plan comprising of various individual responses (Housing Corporation, 2006). Risk Policy Statement Summary Good responses to risks require housing association’s ability to develop a sound corporate governance policy through a formal document duly authorized by the executives and board (Housing Corporation, 2006). The content of the policy addresses the following minimum points: 1. List containing all major risks along with a policy statement of a high level indicating the how the risks can be managed 2. Periodic review procedures and updating the risk register 3. Vibrant allocation of responsibilities addressing each risk 4. Level of decisions to be taken regarding the risk clarification through a system of delegated responsibilities 5. Indication of the fact that organization’s failure risk cannot be eliminated to zero along with identification of tolerance level 6. Details and explanations regarding the procedures taken by the organization for effective risk management, existing procedures for current risks, internal control system effectiveness and compliance with regulatory requirements 7. Membership details of the specific committee addressing risk issue like audit committee etc. 8. Role of internal audit department and the level of procedures used by the internal audit department to address the risks 9. Glossary and definitions of the risk terms and jargons in order to ensure convenient understanding of the risk concept across the organization Three Defense Lines Generally, risks are combated through three different lines as a means of managing risks. These lines are describes as under: 1. First line includes line managers who have the responsibility of identification and management of risks along with implementation of internal controls. 2. Second line includes the independent department designed to address risks such that these departments are quite common in large entities but uncommon in low-scale entities. 3. Third line consists of internal audit department who has the responsibility of reviewing risk management functions and reporting accordingly to the board. However, it is important to note that internal audit department is not responsible for risk management directly as this function relates to line managers and come under their domain. For that reason, this disclaimer by internal audit department should be clearly written, documented and approved by the board (Housing Corporation, 2006). Business Strategy A well-developed approach to risk management is the establishment and formulation of a properly documented business strategy. As risks are those probable events that can harm the organizational goals so if there comes any vagueness regarding the clear business strategy and objective of the association, it would almost be impossible to response adequately to the risks already identified and assessed. A better business strategy comprising of the following points but the list is not exhaustive as more items can make their placement in the list. A properly developed mission statement of the organization indicating the clear purpose of the organization A concise list of the objectives that organization needs to achieve with measurable standards Proper course of actions and strategies to be implemented for the achievement of the identified objectives Risk analysis covering the anticipated areas of risks, their likely outcomes and the strategies to bring them down to an acceptably low level The strategic plan of the organization covers only strategic nature of risks involved. For detailed operational risks, documents other than strategic plans are formulated. Four Ts of Risk management responses Specific risks are responded under the broader area of four Ts which is described as under: 1. Tolerate The types of the risks that have to be borne by the housing association in any manner are only tolerated. These risks are accepted by the associations as per the normal risk appetite of the association. Such are risks documented and approved by the board and included the corporate governance rules of the association. 2. Transfer As a means of responding to certain risks, the associations generally transfer their risks to another party. For instance, insurance companies provide these services of accepting others’ risk against the amount of premium. This risk management approach at times becomes quite tricky for the associations due to their legal complexities. At times, the associations believe that they have made the necessary arrangements to transfer the risks and they are no more exposed to those risks whereas in reality, these risks are still owned by the associations. 3. Treat Treating the risks involves carrying out those steps which can mitigate the occurrence of those events which drives the risks exposures. Associations not only develop such strategies to decrease the likelihood of their occurrences but also takes into consideration the possible ways of reducing the impact of those risks in case if they occur in shape of stringent internal controls and contingency plans. 4. Terminate This strategy is generally overlooked by associations such that they do not focus on terminating those activities that causes risks. Associations should terminate those activities the benefits of which cannot exceed their likely risks impacts. CONTROL ACTIVITIES FOR RISK MANAGEMENT There are various kinds of internal control activities implemented by housing associations to manage risks. Some of these are described as under: 1. Authorization Among all financial controls, authorization controls have the core importance such that they substantially reduce the likelihood of the risks (Housing Corporation, 2006). Under authorization, one person requires the authorization from the other person for making a transaction or any other action. It holds the concept that the authorizer should check the activities of the other person requiring the authorization. The chances of frauds, errors and mistakes are decreased to a significantly low level, as it needs collusion or same mistake committed by two persons. Segregation of duties is the mainstream activity that makes the difference of functions between the activities of the authorizer and the person requiring authorization. In procurement department, authorization plays the most crucial role such that there should be segregation made among the following persons: Person generating the order Person signing the invoice Person responsible for making payment In those events, when larger amounts of transactions are involved, chances for frauds also increase. It becomes the duty of the board to delegate appropriate rights to make expenditures and payments, according to association’s risk appetite (Housing Corporation, 2006). Board also needs to monitor the activities of the executives whether they are breaching the limits that they have been provided. On the other hand, it becomes the duty of the executives to keep an eye continuously upon the line managers not only to reduce the risk of frauds but also to protect themselves against their own investigation held by the board. 2. Reconciliations Another important financial control that reduces the risk to a significantly low level is reconciliation. It works upon the principle that the information coming from two different sources is matched and reconciled. In case of differences and inconsistencies, proper investigations are made to seek the person responsible for the errors or frauds. Bank reconciliation is the most common example of reconciliation control tool. The personnel responsible for the association’s bank balance are compared with the bank statement (Housing Corporation, 2006). In case of any discrepancy, investigation commences and the culprit is sought out. However, it is important to note that there is a need of segregation of duties between the person drafting bank balances and the person carrying out reconciliation duties. Another example of reconciliation is present in tenants register such that the amount of rent arrears is compared with the individual sums of the tenants’ accounts balances. 3. Financial risk management Financial planning, cash flow predictions, professional asset management are the key areas of financial risk management. However, it is near to impossible that smaller housing associations require sophisticated financial instruments for hedging their risk exposures, continuous bank funding and other recovery procedures due to their small size and scale (Housing Corporation, 2006). Generally, smaller housing associations do not rank the financial risks on a higher note. Smaller organizations may not be affected by higher financial risks however operational risks in the form of cash management are still present. Such organizations may not be prone to adverse interest rate fluctuations but they must be afraid of the likelihood of cash shortages due to miscellaneous reasons. 4. Value for money Another important control procedure is the realization of value for money involved in the business transactions. The upside increase in the cost base especially for the smaller associations substantially increase their risk exposure (Housing Corporation, 2006). Value for money should focus on the following activities: Making tenders on competitive basis Proper segregation of duties among all the personnel involved in the transaction Continuous monitoring, review and control 5. Insurance Insurance is considered as the standard kind of the response to transfer the risk to another party. Generally, insurance is used by the housing associations for those risks, the occurrence of which is low but their likely impact is high (Housing Corporation, 2006). Legal risks are still present for the associations such that when larger sums are involved, it becomes quite difficult to recover the whole amount on immediate basis. Housing organizations need to track the amount of premium payments being made to insurance companies and relate them with their risk management policies. In case of excessive premiums, the housing associations require careful review of the policies that they have adopted. 6. Outsourcing Smaller housing associations find it a bit convenient in outsourcing those activities that are not economically beneficial for the associations (Housing Corporation, 2006). For instance, departments like IT, internal audit, security etc. are outsourced to other organizations. There are some drawbacks of outsourcing as well. The outsourced personnel may not provide helpful services to the associations or, become engaged in those activities which are not required by the associations. Works Cited Franck, John Craig, 2008. Business Risk Management. [online] Available at: < http://www.aiu.edu/publications/student/english/Business%20Risk%20Management.html>[Accessed 12th April 2013] Forrest, Ray and Yip, Ngai Ming, 2011. Housing Markets and the Global Financial Crisis: The Uneven Impact on Households. Chicago: Edward Elgar Publishing. Homes and Communities Agency, 2012. Managing risk essential for housing associations’ future. [online] Available at: [Accessed 12th April 2013] Housing Corporation, 2004. HOUSING ASSOCIATIONS AND MANAGING AGENTS. [online] Available at: [Accessed 12th April 2013] Housing Corporation, 2006. Managing Risk for Smaller Housing Associations. [online] Available at: [Accessed 12th April 2013] Moody’s Investor Services, 2012. Announcement: Moodys: English Housing Associations To Manage Downside Risks. [online] Available at : [Accessed 12th April 2013] National Audit Office, 2001. Regulating housing associations management of financial risk. [online] Available at : < http://www.nao.org.uk/wp-content/uploads/2001/04/0001399es.pdf> [Accessed 12th April 2013] Society Guardian, 2008. How the financial crisis will affect the housing and regeneration sectors. The Guardian. [online] 8th October. Available at: [Accessed 12th April 2013] Read More