CMA Final · Entrepreneurship and Startup

Risk Management Strategies: formula sheet

Full chapter guide

Key formulas

Risk score: Risk score = Likelihood score × Impact score; Use the scale given in the question (for example 1 to 5). If no scale is given, state your own and keep it consistent.
Expected loss: Expected loss = Probability of event × Loss if it occurs; Use only when the question gives a probability and a rupee loss. It is not the same as a matrix score.
Process sequence: Identify → Assess → Prioritise → Treat → Monitor and review; Monitoring and review feed back into identification, so the process is a cycle and not a one-time exercise.
Treatment options: Avoid | Reduce | Transfer | Accept; Match the option to the risk: avoid very high risks you can do without, transfer high-impact rare risks, reduce frequent ones, accept minor ones.
Risk exposure (simple rating): Risk exposure = Probability of event × Impact (₹); Used to rank risks before choosing a response. Expected loss is only a guide, not a guarantee.
Residual risk: Residual risk = Inherent risk − Effect of risk responses; A conceptual relation, not an exact arithmetic one. Even after a response, some risk stays.
Cost-benefit test for a response: Adopt the response if reduction in expected loss > cost of the response; Use for reduction and transfer. If the cost is higher than the benefit, acceptance may be better.
Response matching rule: High impact, high likelihood → avoid or reduce strongly (depending on cost-benefit and whether the opportunity is worth the risk); high impact, low likelihood → transfer or share; low impact, high likelihood → reduce; low impact, low likelihood → accept; A rule of thumb for answers, not a law. For the high-high case, avoid only if the loss outweighs the benefit of the activity; otherwise reduce strongly. State your reasoning with the facts given.
Net retained loss under insurance: Retained loss = Actual loss − Insurance recovery + Premium paid; Include the premium as a cost. Recovery is limited by the sum insured, deductible and policy terms.
Insurance recovery with deductible and cap: Recovery = Minimum of (Loss − Deductible, Sum insured); Use when the loss is above the deductible. If loss is below the deductible, recovery is nil.
Forward hedge outcome for an importer: Rupee cost = Foreign currency payable × Forward rate; The cost is fixed at the forward rate, whatever the spot rate on the payment date.
Gain or loss versus staying unhedged: Hedge benefit = Foreign currency amount × (Spot at settlement − Forward rate); For a payable: positive means hedging saved money. For a receivable, reverse the sign.
Principle of indemnity: Claim ≤ Actual loss; Insurance indemnifies the loss. You cannot profit from a claim, subject to the sum insured.
Risk rating (score): Risk score = Likelihood × Impact; Use the same scale for all risks (for example 1 to 5 each, giving a score up to 25). Scales are a choice of the venture, not a fixed standard.
Expected loss: Expected loss = Probability of event × Loss if it occurs; Useful to rank risks in rupees. It ignores very rare but severe events, so judge those separately.
Residual risk: Residual risk = Inherent risk − Effect of controls and responses; This is a concept, not exact arithmetic. Inherent risk is before controls; residual is what remains.
Appetite versus tolerance: Risk appetite = broad level of risk accepted; Risk tolerance = measurable limit for an objective; Tolerance must sit inside appetite and be expressed in numbers where possible.
COSO ERM components: Governance and culture; Strategy and objective-setting; Performance; Review and revision; Information, communication and reporting; Learn these five in order. They are the base for framework questions.
Contingency plan structure: Trigger event → Trigger point → Action → Owner → Resources → Time limit; Use this to write any fallback plan in an answer. A trigger point is the signal that activates the plan.
Recovery Time Objective (RTO): RTO = maximum acceptable time a function can stay down; Set per function. Critical functions get shorter RTOs.
Recovery Point Objective (RPO): RPO = maximum acceptable data loss, measured in time since the last backup; If RPO is 4 hours, backups must be taken at least every 4 hours.
Cash runway (continuity check): Runway (months) = Available cash ÷ Monthly net cash burn; Shows how long the startup can survive a disruption with no revenue recovery.

Quick revision

Risk is uncertainty that can affect a startup's objectives, and it can hurt or help.
Common startup risk types: market, financial, operational, technology, legal and compliance, people, and reputation.
Process: identify, assess, respond, monitor and review.
Assess risk using likelihood and impact, and rank the risks.
The four basic responses are avoid, reduce, transfer and accept.
Accept a risk only when it is small or the cost of treating it is higher than the benefit.
Insurance transfers financial loss for a premium but does not remove the risk itself.
Contracts can shift risk through clauses such as indemnity, limits of liability and warranties.
A framework assigns ownership, reporting lines and review of risks.
Risk culture starts with founders who discuss risks openly and reward early reporting.
A contingency plan covers specific events; a continuity plan keeps critical functions running.
Always end a case answer with a clear, reasoned recommendation.

Common mistakes

Treating risk and failure as the same thing. Fix: Define risk as uncertainty of outcomes. Failure is one possible result, and gain is the other.
Labelling every cash problem as financial risk. Fix: Ask why cash fell. Poor sales is market risk. A late supplier is operational. Heavy debt is financial.
Listing risks and stopping there Fix: Cover all stages. Even a line each for assessment, treatment and monitoring earns marks.
Giving generic risks that ignore the case Fix: Quote case facts, such as a single supplier or a short cash runway, and build each risk from them.
Treating transfer and sharing as the same thing. Fix: Ask whether the partner also shares the reward and stays involved. If yes, it is sharing. If you only pay a fee to move the loss, it is transfer.
Calling insurance a complete removal of risk. Fix: Say insurance transfers the financial loss. Reputation, delay and uninsured items remain as residual risk.
Saying transfer removes the risk. Fix: Write that only the financial consequence moves. The event can still occur and some loss is retained.
Treating key man insurance as cover for the employee's family. Fix: Remember the company is the policyholder and beneficiary, and it needs an insurable interest in the key person.
Treating risk appetite and risk tolerance as the same thing. Fix: Say appetite is the broad level of risk the venture will take for its goals, and tolerance is the specific limit on an objective, such as minimum cash runway.
Describing risk management as the job of one risk officer only. Fix: Show that every risk owner manages risk in their area, and the coordinator only supports and reports. Culture needs everyone.

Exam tips

In case scenarios, quote the exact fact that shows the risk, then name the type.
Learn the six types in a fixed order so a classification answer is complete under time pressure.
Always give a startup example. Generic definitions earn fewer marks than applied answers.
For MCQs, pick the root cause when two types seem to fit.
Prepare the business risk versus financial risk contrast. It is a likely short-note or distinction question.
Tie every point to a fact in the case scenario. Generic answers score poorly in application questions.
Use a small matrix or a list of scores to show the working. Examiners reward visible logic.
In MCQs, watch for the order of stages and for the difference between avoid, reduce, transfer and accept.