risk profile

What is a risk profile?

A risk profile is a quantitative analysis of the types of threats an organization, asset, project or individual faces.

The goal of a risk profile is to provide a nonsubjective understanding of risk by assigning numerical values to variables representing different types of threats and the dangers they pose.

Each organization has its own unique risk profile, based on the assets it wants to protect, the goals it wants to achieve, its ability to handle risks and its willingness to do so.

Organizations use risk profiles to align their strategy and actions with their risk appetite, that is, the level of risk they are willing to accept after the relevant controls have been put in place.

In the enterprise, the ability of a management team to understand and measure gaps between the company's risk profile and its risk appetite is an important aspect of running a successful enterprise risk management program.

In finance, a risk profile can be a useful tool for discussing and evaluating a potential investment's ability to maximize return on investment while minimizing risk.

Individuals can also develop a risk profile as they seek to make decisions that align with their risk appetite. For example, individuals often develop a risk profile to help them make investment decisions that aren't too risky for them but still enable them to set and reach financial objectives.

What is included in a risk profile?

A risk profile considers the following:

• the nature of the threats which face an organization as it operates and works toward its objectives;
• the degree to which those threats could adversely impact the organization;
• the likelihood that those threats will have an impact on the organization;
• the type of disruptions that could occur if those threats impact the organization;
• the costs associated with each type of risk; and
• the controls that the organization has in place to manage or mitigate the identified risks that face the organization.

What types of risk should be accounted for?

As noted, every enterprise has its own unique mix of risk factors, but those risks generally fall within one of four risk categories:

1. Strategic risks. These could come from outside forces, such as competitors entering new markets, technology innovations rendering the organization's products or services obsolete, or unexpected significant shifts in customer demands.
2. Operational risks. These are issues that could disrupt the day-to-day running of the organization; supply chain problems, personnel issues, equipment malfunctions and disputes with third-party partners are some of the risks that could impact an organization and thus should be considered when developing a risk profile.
3. Financial risks. These could include disruptions in cash flow, the lack of needed liquidity and interest rate fluctuations.
4. Compliance, legal and regulatory risks. These could be the passage of new rules that could impact the organization, regulator findings of noncompliance that result in fines or legal actions, and lawsuits.

How to create a risk profile

Developing a risk profile should involve stakeholders throughout the enterprise who work together to complete the following tasks:

1. Establish the organization's risk appetite, considering the enterprise capability to deal with risk, and its risk tolerance -- the deviation from risk appetite its willing to assume to accomplish specific goals.
2. Identify all potential risks within each of the four risk categories listed above that could negatively impact their organization, the level of impact those risks could have and their probability of occurrence.
3. Rank, or prioritize, risks based on the impact they could have on the enterprise, as well as the likelihood they could happen. An organization may want to develop a risk map, which is a visual representation of this information.
4. Further rank risks by organizational units, risk types, geographies, strategic objectives and/or other relevant subcategories.
5. Determine the format that best suits the presentation of the risk profile so that the information is readily understandable to the stakeholders who will use the profile for decision-making.

Enterprise executives should work to include the risk profile as part of their strategic planning and ongoing decision-making processes. They should also use it to inform the governance and controls they implement to manage and mitigate risk.

Moreover, they should ensure that they revisit the risk profile on a regular cycle and update it whenever risks, the organization's appetite for risk or both significantly change.