Risk Management: formula sheet

Key formulas

Basic risk exposure (qualitative rating)

Risk rating = Likelihood × Impact

Used to rank risks on a scale such as 1 to 5 each. A higher product means higher priority. Scales are set by the company, not fixed by law.

Risk management process

Context → Identify → Analyse → Evaluate → Treat → Monitor and Review (with Communication throughout)

Frameworks word the steps slightly differently. Learn the sequence and use the same logic in your answer.

Risk treatment options

Avoid | Reduce (mitigate) | Transfer (share) | Accept (retain)

Transfer includes insurance and outsourcing. Accepting a risk should be a conscious decision within risk appetite.

Risk classification by source

Internal risks + External risks

Add the nature-based types (strategic, operational, financial, compliance, reputational, technology, ESG) for a full answer.

Risk appetite and tolerance

Risk capacity ≥ Risk appetite ≥ Risk tolerance (limit around the appetite)

Capacity is the maximum the firm can bear, appetite is what it is willing to take, tolerance is the acceptable deviation. Keep the three terms separate.

COSO ERM (2017) components

Governance and Culture + Strategy and Objective-Setting + Performance + Review and Revision + Information, Communication and Reporting

Five components, 20 principles. The components are interrelated, not a strict one-way sequence. Learn the order as given.

ISO 31000:2018 principles

Integrated; Structured and comprehensive; Customised; Inclusive; Dynamic; Best available information; Human and cultural factors; Continual improvement

Eight principles. The central purpose is the creation and protection of value.

ISO 31000 risk management process

Communication and consultation + Scope, context, criteria → Risk assessment (identify, analyse, evaluate) → Risk treatment → Monitoring and review → Recording and reporting

Communication and consultation, and monitoring and review, run alongside all other steps.

ISO 31000 three elements

Principles + Framework + Process

Principles guide, the framework embeds risk management in the organisation, the process applies it to decisions.

Core difference

COSO ERM = risk linked to strategy and performance; ISO 31000 = generic principles-based guideline

Use this one-line contrast to open any 'distinguish' answer.

Risk score (semi-quantitative)

Risk score = Likelihood score × Impact score

On a 5 × 5 scale the score ranges from 1 to 25. Cut-offs for low, medium and high are set by the company, not fixed by law.

Expected loss

Expected loss = Probability of event × Loss if it occurs

Use for quantitative ranking. A 10% chance of a ₹50,00,000 loss gives ₹5,00,000.

Residual risk

Residual risk = Inherent risk − Effect of controls

Conceptual relation, not an exact arithmetic subtraction. It shows risk left after controls work.

Risk register fields

ID, description, category, cause, likelihood, impact, score, owner, controls, action, status

A good register has an owner and a review date for every risk.

Residual risk

Residual risk = Inherent risk − Effect of controls and treatment

A conceptual relationship, not an arithmetic one in the exam. Inherent risk is the level before any response. Residual risk must be within risk appetite.

Four core responses

Avoid | Reduce | Transfer | Accept

Remember as ARTA. Avoid removes the activity, reduce lowers likelihood or impact, transfer shifts financial consequence, accept retains the risk knowingly.

Selection rule

Choose the response whose cost is justified by the reduction in risk and which brings residual risk within appetite

Use this as the reasoning line in every answer. Cost-benefit plus risk appetite decides the choice.

Control types

Preventive + Detective + Corrective

Preventive stops the event, detective finds it, corrective repairs and recovers.

Reporting chain

Risk owner → Risk management committee → Audit committee / Board

Escalation path used in most company risk structures. Adapt the names to the facts in the question.

Risk rating

Risk score = Likelihood × Impact

Use the same scale (for example 1 to 5) for every risk so that ESG risks can be ranked beside financial risks.

Climate risk classification

Climate risk = Physical risk (acute + chronic) + Transition risk (policy + technology + market + reputation)

A memory aid for classification, not a numeric formula. Always place each example under one head.

TCFD four pillars

Governance → Strategy → Risk management → Metrics and targets

Use as the answer skeleton for any climate disclosure or integration question.

Risk treatment options

Avoid / Reduce (mitigate) / Transfer / Accept

Pick the option that matches the risk and justify it.

Board's report risk disclosure

Section 134(3)(n), Companies Act, 2013

Statement on development and implementation of the risk management policy, including elements of risk that may threaten the company's existence. Applies to the Board's report generally.

Audit committee and risk

Section 177(4), Companies Act, 2013

Terms of reference include evaluation of internal financial controls and risk management systems. The RMC does not replace this role under the Act.

Independent directors' duty

Schedule IV, Part II

Satisfy themselves that financial controls and systems of risk management are robust and defensible.

Who needs an RMC

Regulation 21, SEBI LODR: top 1000 listed entities by market capitalisation

Others may constitute it voluntarily. Check the current applicability criteria in the Regulations before answering.

RMC composition

Minimum 3 members; majority from the board; at least 1 independent director; chairperson a board member

Senior executives may also be members. A chairperson who is not a director breaches the rule.

RMC meetings

At least 2 meetings a year; gap between two consecutive meetings not more than 180 days

Both conditions must be met. Two meetings a year can still breach the 180-day gap.

RMC quorum

Higher of 2 members or one-third of members, including at least 1 board member

Example: 9 members gives one-third = 3, so quorum is 3.

RMC role

Risk policy + monitoring + review at least once in 2 years + reporting to board

Policy covers internal and external risks including financial, operational, sectoral, sustainability (ESG), information and cyber security risks, mitigation measures and a business continuity plan.

Board responsibility for risk

Regulation 17(9), SEBI LODR

Board frames, implements and monitors the risk management plan and ensures procedures to inform members about risk assessment and minimisation.

Quick revision

• Risk is the possibility that an event affects objectives, and it can be a threat or an opportunity.
• Risk management is a continuous cycle, not a one-time exercise.
• ERM looks at risk across the whole organisation, not department by department.
• The standard process runs: identify, assess, measure, treat, monitor, report.
• Assessment considers likelihood and impact; a risk matrix combines the two.
• Treatment options include avoiding, reducing, sharing or transferring, and accepting the risk.
• Residual risk is what remains after controls and treatment.
• Climate risk is commonly split into physical risk and transition risk.
• ESG risks can become financial risks through cost, reputation, legal and access-to-capital effects.
• The board is accountable for risk oversight; management runs the day-to-day process.
• Always link a risk response to disclosure and reporting in a case answer.
• Finish each case answer with a clear conclusion and a practical recommendation.

Common mistakes

• Defining risk only as loss or danger. Fix: Define risk as uncertainty about outcomes that can affect objectives, and mention that it can also mean missed opportunity.
• Saying risk management means eliminating all risk. Fix: State that the aim is to take informed risks within risk appetite. Some risks are accepted or even sought for returns.
• Mixing up the COSO ERM 2004 'cube' components (such as internal environment and objective setting) with the 2017 five components. Fix: Use the 2017 five components only. Mention 2004 only if the question asks about evolution.
• Calling ISO 31000 a certifiable standard or a legal requirement. Fix: Write that ISO 31000 provides guidelines. It is not meant for certification and is not mandatory by itself.
• Confusing risk identification with risk assessment. Fix: Identification asks what can go wrong. Assessment asks how likely and how bad. Answer each separately.
• Saying quantitative is always better than qualitative. Fix: Say it depends on data. Qualitative suits new or intangible risks such as reputation. Quantitative suits risks with good data.
• Treating transfer as removing the risk completely. Fix: Say that transfer shifts the financial loss only. Legal liability, reputation and regulatory duties usually remain, and insurance has exclusions and limits.
• Confusing avoidance with reduction. Fix: Avoidance means the activity stops entirely. Reduction means the activity continues with controls. Test: does the company still do the activity?
• Calling a carbon tax or new emission rule a physical risk. Fix: Ask whether the cause is the climate itself (physical) or the response to climate change (transition).
• Treating ESG risk as a separate exercise from ERM. Fix: State that ESG risks go into the same risk register, rating scale, ownership and board reporting as other risks.

Exam tips

• Begin every answer with a short definition. It is the surest mark in a theory question.
• Use headings in the answer such as Meaning, Types, Process, Conclusion. Examiners find points quickly.
• For case questions, name the risk type from the facts and recommend one of avoid, reduce, transfer or accept, with a reason.
• Keep the process steps in order and mention monitoring and communication. These are the steps students most often leave out.
• Give one real or realistic Indian example per type of risk to show application.
• Learn the five COSO ERM 2017 components in order and be ready to attach one line to each.
• Always state the ISO 31000 edition. Use the eight principles of 2018.
• For 'distinguish' questions, give at least five points in a two-column layout of heads, and state the key contrast first.