Managing, monitoring and mitigating risk: formula sheet

Key formulas

Risk process cycle

Identify → Assess → Profile → Respond → Monitor and report → repeat

Use this as the structure for any process question. The cycle repeats because risks change.

Risk rating (scoring)

Risk score = Likelihood score × Impact score

A common scoring method, not a fixed rule. For example, likelihood 4 × impact 5 = 20. State the scale you use, because ACCA does not prescribe one.

Expected loss

Expected loss = Probability of event × Financial impact

Use only when you have a probability and a money figure. It ignores non-financial effects and rare, severe events, so say so.

Residual risk

Residual risk = Inherent risk − Effect of controls

This is a conceptual relationship, not an arithmetic one. Controls reduce, but rarely remove, risk.

Appetite vs tolerance

Appetite = broad level of risk accepted. Tolerance = acceptable variation from a specific target or limit.

Appetite is set by the board. Tolerance turns it into measurable limits.

TARA responses

Transfer | Avoid | Reduce | Accept

Name the response, then say exactly what action it involves in the scenario.

Likelihood and impact guide

Low L, low I → Accept; Low L, high I → Transfer; High L, low I → Reduce; High L, high I → Avoid or Reduce

A rule of thumb only. Risk appetite, cost and strategic importance can override it.

Cost-benefit test for a response

Respond if expected benefit (loss prevented or reduced) > cost of the response

Use it to justify accepting a risk or rejecting an expensive control.

Residual risk

Residual risk = inherent risk − effect of the response

Conceptual, not numeric. After responding, check residual risk is within appetite.

Basic risk definition

Risk = uncertainty about events that affect objectives

Link every risk you identify to an objective of the organisation in the case.

Main risk categories

Strategic | Operational | Financial | Compliance | Reputational | Technological | Other

Use as a checklist when scanning a case. Other includes environmental, political, human resource and project risks.

Business risk vs financial risk

Business risk = from operations and environment; Financial risk = from financing and market prices

Business risk exists with no debt. Financial risk adds to it when debt or foreign currency is used.

Risk description pattern

Cause → Event → Effect on objective

Write each risk in this three-part form so it is specific, not generic.

Board responsibility

Board = overall ownership of risk, appetite and review of effectiveness

Responsibility can be delegated for oversight, but never removed from the board.

Three lines model (simple form)

1st line: managers and staff own and manage risk | 2nd line: risk manager/CRO and risk committee oversee and support | 3rd line: internal audit gives independent assurance

A useful structure for organising answers. Name it as a framework, not as a legal rule.

Embedding risk culture

Tone at the top + clear policies + training + aligned incentives + open communication + safe reporting

Use as a checklist of levers when asked how to build a positive culture.

COSO components

Control environment + Risk assessment + Control activities + Information and communication + Monitoring activities

Use as a checklist. Name only those relevant to the scenario.

Weakness answer chain

Weakness → Risk → Consequence → Recommendation

Use this chain for each control point to earn application and analysis marks.

Monitoring levels

Management (ongoing) → Internal audit (independent) → Audit committee (oversight) → Board (responsibility)

Shows who monitors and who reports to whom.

Control types

Preventive, detective, corrective (also directive)

Preventive stops the problem, detective finds it, corrective fixes it.

COSO ERM (2017) components

Governance and culture → Strategy and objective-setting → Performance → Review and revision → Information, communication and reporting

Five components. Use them as a checklist to assess a company's risk system.

ISO 31000 structure

Principles + Framework + Process

The process runs: communication and consultation; scope, context and criteria; risk assessment (identify, analyse, evaluate); risk treatment; monitoring and review; recording and reporting.

UK Corporate Governance Code board duty on risk

Board determines the nature and extent of principal risks it will take, maintains sound risk and control systems, and reviews their effectiveness at least annually

State this as a board responsibility. It is a duty, not a framework.

Core contrast

COSO ERM = strategy and performance focus; ISO 31000 = generic principles, framework and process

Both are principles-based and flexible. Neither is a legal requirement by itself.

Mitigation focus

Risk = Likelihood × Impact. Controls mainly reduce likelihood. Continuity and crisis plans mainly reduce impact.

Use it to explain why planning is still needed even when controls exist.

Plan hierarchy

Contingency plan (specific event) → Business continuity plan (critical activities) → Crisis management plan (organisation-threatening event)

Use the terms precisely. They overlap but are not identical.

Business impact analysis questions

Which activities are critical? What is the cost of interruption? How long can the business tolerate it? What resources restore it?

These questions structure most BCP answers.

Plan life cycle

Analyse → Design → Communicate → Test → Review and update

Examiners often reward comments on testing and review.

Quick revision

• The risk process: identify, assess, respond, monitor and report, then repeat.
• Assess risk by likelihood and impact, and say which risks need attention first.
• TARA means transfer, avoid, reduce, accept.
• Transfer shifts the financial effect, for example by insurance or contract, but not always the responsibility.
• Avoid means not doing the activity, which may also lose the reward.
• Reduce lowers likelihood or impact through controls; accept is a conscious choice when the risk is within tolerance.
• Link every risk to the scenario and name the business effect.
• Risk culture is shaped by tone from the top, incentives and how people behave when things go wrong.
• The board is responsible for risk oversight; management runs the process day to day.
• Internal controls and monitoring check that responses work and reveal new risks.
• Frameworks give a structured approach, but you must tailor advice to the case.
• Business continuity plans cover recovery of operations; crisis plans cover leadership and communication during a major event.

Common mistakes

• Listing generic risks that are not in the scenario. Fix: Use each category only if the case gives evidence. Quote the fact, then explain the risk it creates.
• Rating risks without explaining why. Fix: Give a reason for each rating, linked to a scenario fact such as a supplier dependence or a past incident.
• Only naming the response, such as 'transfer', with no action or scenario link. Fix: Always give the specific action and tie it to a scenario fact, for example 'insure the cargo fleet because one loss would be severe'.
• Confusing avoidance with reduction. Fix: Avoidance stops the activity completely. Reduction keeps the activity and adds controls. If the business still does the thing, it is not avoidance.
• Listing generic risks such as 'there is a financial risk' without using the case facts. Fix: Use the cause, event, effect pattern with a named fact from the case, such as a supplier, a loan or a regulator.
• Confusing business risk with financial risk. Fix: Ask: does the risk come from how the business operates and its market, or from financing and market prices? The first is business risk, the second is financial.
• Saying the risk committee or CRO is responsible for risk instead of the board. Fix: State that the board stays ultimately responsible. The committee and CRO oversee and advise.
• Listing roles generically without using the scenario. Fix: Tie every role to a specific fact, such as a CRO who reports only to the finance director.
• Listing COSO or control types from memory without applying them. Fix: Use the framework only to find issues in the scenario. Every point must refer to the facts given.
• Stating a weakness without explaining the risk or consequence. Fix: Always complete the chain: weakness, risk, consequence, recommendation.

Exam tips

• Always tie risks to scenario facts. Generic lists earn few marks, but quoted evidence plus analysis scores well.
• Write the likelihood and the impact separately for each risk, and give a reason for each.
• Use the board's stated appetite from the case when recommending responses. If none is given, say what you assume.
• Keep numbers simple. State that probabilities are estimates and that expected loss ignores non-financial effects.
• Present the answer in the requested format, such as a report or briefing note, with a clear recommendation to earn professional skills marks.
• Link every response to a scenario fact. A correct label with no application earns little.
• Use professional skills: weigh options and give a clear recommendation rather than a list.
• Show the trade-off. Say what each response costs and what it gives up.