Component 3: Risk management — Eduqas A-Level Business

Businesses encounter diverse operational and strategic risks. Physical risks include natural disasters (floods, severe weather) and equipment/technology failures (machinery breakdown, IT crashes, cyberattacks). Human risks include employee error and industrial action. Supply risks involve component shortages, delivery delays, or supplier insolvency. Macroeconomic risks include inflation, interest rate hikes, and recession. Legal and compliance risks involve litigation and regulatory penalties. Reputational risks include public relations crises and product safety failures.

Risk management evaluates threats by combining likelihood (probability of occurrence) and impact (financial and operational severity). High-probability, high-impact risks (e.g. cyber security breaches in e-commerce) justify substantial preventative spending on firewalls, backup servers, and staff training. Low-probability, low-impact risks are tolerated without significant expenditure. For low-probability, high-impact risks (e.g. fire destroying a warehouse), businesses purchase insurance rather than over-investing in physical prevention.

A structured sweep of a workplace or a project that finds hazards, judges how likely each is and how badly it would hurt, then records the controls and a review date. Employers in the United Kingdom with five or more staff must record their findings under health and safety regulation, so for most firms this is a legal duty as well as a management tool. The output is usually a matrix scoring likelihood against severity, which sorts hazards into those to design out, reduce, transfer or simply accept. Its weakness is that it only ever catches what somebody thought to list, it dates quickly when processes or suppliers change, and it can decay into a signed form nobody reads. Done properly it shows up in the numbers as fewer lost time accidents, lower premiums and less downtime; done badly it buys cost and false confidence.

Prevention changes the odds before anything goes wrong, and the three examples in this part of the course map neatly onto the three families of control. Physical controls such as sprinklers, fire doors and machine guards cut the severity of an incident and often cut the insurance premium enough to part fund themselves. Technical controls such as off site or cloud copies of data, with a restore that has actually been tested, turn a ransomware attack or a server failure from a closure into a few hours of lost work. People controls such as induction, manual handling and cyber awareness cut the frequency of the mistakes that cause most claims. Each carries a certain cost now against an uncertain saving later, which makes the decision a payback style judgement, and training only repays the firm if labour turnover is low enough for it to keep the people it has trained.

Insurable risks are pure risks where there is only the possibility of financial loss or no loss (such as fire, theft, flood, or employee injury), with historical actuarial data allowing commercial insurers to calculate probability and set premiums. Uninsurable risks are speculative risks where there is potential for either profit or loss (such as launching a new product, competitor price wars, or entering foreign markets), or unquantifiable systemic disasters where probabilities cannot be calculated.

Contingency planning is proactive preparation undertaken before a crisis occurs, identifying potential risks and formulating detailed operational action plans, alternative resource arrangements, and emergency procedures. Crisis management is the reactive operational response executed during and immediately following an emergency, coordinating clear stakeholder communication, damage containment, and business continuity (such as KFC's response to its UK supply chain collapse in February 2018).

Each of the four levers buys resilience and each costs something, and the marks are in that trade off. A reserve of cash, often set as a stated share of turnover or of a project budget, is available on demand but earns almost nothing, so it drags on return on capital employed while it sits there. A second supplier, a mothballed line, spare capacity or a subcontractor on standby shortens an interruption but raises unit costs and lowers capacity utilisation, which is actual output divided by maximum possible output multiplied by one hundred. Deciding in advance who is in charge removes the argument at the worst possible moment, and only works where deputies are named and the plan is rehearsed. Handling the public side with one trained spokesperson, fast honest updates and a visible remedy protects the brand, which is the slowest asset to rebuild.

There are only four things a firm can do with a threat: accept it and absorb the loss, reduce it with controls, shift it to somebody else through insurance or a contract clause, or stop the activity that creates it. Plotting each hazard on a likelihood and impact grid usually decides which one applies, so rare but catastrophic events are transferred, frequent but minor ones are reduced, trivial ones are tolerated, and a hazard that is both likely and severe puts the activity itself in question. A strong answer then tests the choice against the firm objectives, cash position, size and appetite for risk, and against the time horizon, because a fast growing firm may rationally accept exposures a mature one would insure. The counter worth making is that over controlling raises fixed costs and slows decisions, and some risk taking is what earns the return.

This work is judged by who it protects and at what price. Employees gain safer workplaces and more secure jobs; customers gain continuity of supply and safer products; suppliers gain stable orders and a buyer still able to pay after a shock; lenders and insurers price a well controlled firm more cheaply, which shows up in both gearing costs and premiums; owners gain protection of asset value and a smoother earnings stream, and markets punish surprises more harshly than known problems. Against that sit the cash cost, the management time, and the danger that a thick document creates false confidence in scenarios nobody ever rehearsed. The conflict worth writing about is short term profit against long term resilience, and the judgement turns on sector, size and exposure, since a chemical plant and a two person consultancy are not making the same decision.