SOME USEFUL METHODOLOGY

The following are some notes on two risk techniques that have been found to be useful in the sector.

Risk Appetite Determination

The sector has had a number of cases where associations have taken on rather more risk than their risk capacity allowed. As part of the process of establishing the context for risk management in the sector, answering the following questions has been found to be helpful:

Ql: How much risk do we think we are taking (risk perception)?

Q2: How much risk are we actually taking (risk exposure)?

What evidence have we got that the assessment is correct? If there are gaps, biases, or incorrect assessments in the risk map, our perception will be incorrect.

Q3: How much risk do we usually like to take (risk propensity/culture)?

If this is less than Ql, then we will feel uncomfortable.

Exhibit 8.1 Sample Probability Scale

Q4: How much risk could we safely take (risk capacity)?

This should be bigger than Ql, Q2, and Q3. It mainly depends on financial strength and covenants, but also a view of response speeds should things start to go wrong.

Q5: How much risk do we think we should be taking (risk attitude)?

We may feel we should be doing things but we don't currently have the capacity to do them.

Q6: How much risk do we actually want to take (risk appetite)?

This is perhaps a compromise!

Q7: How do we set controls and limits across products and parts of the business, so that we can be confident that our total risk appetite is not exceeded (risk limits)?

Risk Assessment Methodology

There are technical difficulties in assessing the risks in housing associations, largely concerned with their mix of financial and social objectives. A successful approach to risk assessment for the sector has been developed, as described in Chapter 13 of Fraser and Simkins (2010) and summarized in Exhibits 8.1 and 8.2.

It is difficult to assess a risk that has several types of impact, but the task is considerably simplified if you use a clear set of criteria^[1] such as those given in Exhibit 8.2.

When using the scale in Exhibit 8.2 to assess a risk, one should decide which is the highest type of impact and make the assessment based on the assessed level of this type of impact. Thus if a risk has mainly staff impact, and many staff are significantly affected, then the risk would be recorded as impact score 4. Similarly, if another risk would result in major reputational damage, the score would be 4. However, if a risk has two or more types of impact at the same level, then the score would be one degree higher (i.e., a score of 5 in the example).

• [1] See section 5.3.5, "Defining Risk Criteria," in ISO 31000:2009.