Managing Strategic and Operational Risk

Managing Strategic and Operational Risk
[Name]
[Course Title]
[University]
[Instructor Name]
[Date]
Risk is the probability of happening of something that might affect the performance, profitability and stability of an organization. In an organization, a scenario where risks are inevitable is difficult to find. An organization without risks can only be a theoretical myth but in reality, risks are present in each corner of an organization. In order to save an organization from the threats posed by the risks, an organization must implement upon certain safeguards. Such safeguards might include; periodic risk assessment, establishment of Standard Operating Procedures (SOPs) and internal audits (Alexander, 2005).

RISKS IN ORGANIZATIONS
In accordance with the effect they might have, risks in organizations are normally classified as low, medium and high. It is a function of the organization to classify a risk in one of these categories. Some risks are of a trivial nature but some risks are so significant they threaten the survival of an organization. Since risks are also a part of an organization, they can never be ignored (Crockford, 1986). If an organization ignores the risks it faces in its day to day operations, the organization might not survive in the industry for a significantly long period of time. Ignorance of risks does nothing but escalates the situation and makes it even worse. Periodic review of risks is highly important for the unhindered performance of the operations of an organization therefore assessment of risks has been adopted as a full fledged function of each organization. The main function of the risk management department is to ensure that all other functions of the organization are performing just as they are supposed to perform. This function is given significant importance in new organization because the business world has realized the threats posed by risks, irrespective of the nature of the risks (Heldman, 2005).  
As mentioned earlier, risks are of various intensities. Some risks are classified as low intensity risks which can be temporarily ignored and can be dealt with later. On the other hand, some risks are so significant, they need to be dealt with on timely basis otherwise they might harm the existence of the organization. Significant risks can be found in almost all the operations of an organization. An organization faces risks when it makes any new investment, when it recruits new employees, when it delegates authority and at so many more instances (Coyle, 2004). 
At the time of a new investment, the possible risks that an organization might face are; the anticipated returns might not be achieved and the organization might have to face loss. The project in which the organization makes investment might not be successful due to any unforeseen change in economic situation of the region, any unforeseen development in the technology, or any social or environmental changes (Newman, 1998). Such factors directly affect the investment of the organization and they can be classified as risks because they threaten to hinder the trend of profitability of an organization. 
Another instance of risk may be in the recruitment of new employees because new inductees are given confidential information regarding the organization which may be used unethically. If an organization does not ensure the ethical values of the new inductees before hiring them, it might affect the performance of the organization to a significant extent. Similarly when the personnel with higher authority delegate a part of their authority to their subordinates, the subordinates might use that authority for their personal means. This might also be a risk for the organization and it can affect the operations of an organization. Risks that may be caused by the delegation of authority are; collusion, misappropriation of cash, misappropriation of assets or embezzlement (Crouchy, 2001).  
RISK MANAGEMENT
The Risk Management Process is a systematic application of management policies, procedures and practices that already exist to the tasks of identifying, assessing, treating and monitoring risk (Dorfman, 2007). In order to survive in the industry and to save itself from any crisis, an organization needs to be aware of all the risks that are present in the operations of the enterprise. This is the most imperative step to save an organization from the threats posed by the risks.
Risk Assessment
In order to know the risks posed to the operations of the organization, an organization needs to conduct a number of procedures. Initially an organization must assess the industry in which it operates. The past practice of other organizations and the nature of policies and procedures they apply may give the organization a general idea regarding the nature of risks that might be present in the industry in which it operates.
After analyzing the industry, an organization must assess its own strategies and business plans, and ultimately its operations and the way they are performed. This is the most important step because risks that are organization specific are difficult to be analyzed. Internally occurring risks are mainly due to the policies and procedures adopted by the organization. An organization may conduct a periodic review of its internal operations and it should assess the areas which may be susceptible to risks.
Strategic Risk
Strategic risk is the probability of impact on the capital or profitability of an organization due to the decisions made by the strategic core of the organization. Each decision made by an organization contains some proportion of risk in it. A decision for expanding the business or modifying the existing plan, irrespective of the nature of the decision, it contains some risk. Strategic risk is mainly caused by the adverse business decisions, improper implementation of the decisions, or the inability of the organization to respond to the changes in the industry on a timely basis. This risk is a function of all the processes involved in the decision making in an organization.
There are certain indicators that can also be used to assess the level of strategic risk present in an organization. The indicators that show that an organization has a low level of strategic risk are: risk management practices are given significant importance and these are an important part of the organization’s strategic planning; organization’s vision, mission, goals and objectives are clearly communicated throughout the organization and these are implemented consistently; the management of the organization has been successful in implementing its previous goals and objectives; management makes use of its information system in decision making consistently; new strategies designed by the strategic core are supported by due diligence and risk management functions and; the decisions made by the organization are easily reversible if they are evaluated to be ineffective. All these indicators show that an organization needs to have a perfectly aligned system throughout its structure. Therefore, the level of risk can be lowered if an organization adopts these factors.
The indicators that show that a moderate level of risk is present in the organization are: the organization has a consistent quality of risk management against the identified issues and problems; management possesses all the resources to initiate the implementation upon the strategies and decisions, and the effective implementation is likely; management possesses a convincing past practice in implementation of strategies and decisions; the information system of the management is reasonable in supporting the strategic core in designing strategies and making decisions; strategic initiatives would not change the direction of business conducted by the organization, and they are likely to be implemented in a cost effective and efficient manner (Frenkel, 2005). Thus, from the above indicators, it can be inferred that a moderate level of risk is present in the organizations that do not possess a perfect past record of the implementation of their strategies and decisions, and they do not have a prospective of perfect implementation of their strategies but a reasonable action is likely. Therefore, in order to drive an organization out of the area of moderate risk into the area of no or low risk, an organization must assess the effectiveness of the implementation of its strategies, and it should also evaluate whether it possesses enough resources to act upon its decisions (Borodzics, 2005).
The indicators that show a high level of risk in an organization are: practices of risk management in an organization are not consistent with the strategic initiatives and the direction of strategies is also not clear; the organization does not possess suitable resources to support its strategic initiatives, and the structure of the organization does not support long term strategies; the organization has deficiencies in its risk management that hinder the effective evaluation of risks, resources and strategies; there are serious flaws in the management’s information system or the information system does not exist; the strategies designed by the organization are incompatible with the existing systems being implemented by the organization; and the goals of the strategies are not clear. From the above indicators, it can be inferred that an organization is exposed to a high level of strategic risk when it does not possess adequate resources to implement the decisions or the focus of those strategies is not specific. Therefore, in order to save an organization from a high level of strategic risk, the management must assess the availability of resources and the ...