Component 3: Risk management — Eduqas A-Level Business

Every threat has two dimensions, likelihood and impact, and a firm ranks threats on both before deciding what prevention is worth buying. The working rule is that spending on control should not exceed the expected cost of the hazard, where expected cost is probability multiplied by the loss if it occurs, so a one in three chance of a loss of ninety thousand pounds carries an expected cost of thirty thousand pounds and justifies up to roughly that much. A frequent but cheap event, such as short stock outages at a bakery, is usually absorbed; a rare but ruinous one, such as a warehouse fire, is transferred to an insurer rather than engineered out. Cash spent on control is an opportunity cost against marketing or new equipment, so the judgement in the exam is where the marginal pound buys the most protection for the named firm.

A structured sweep of a workplace or a project that finds hazards, judges how likely each is and how badly it would hurt, then records the controls and a review date. Employers in the United Kingdom with five or more staff must record their findings under health and safety regulation, so for most firms this is a legal duty as well as a management tool. The output is usually a matrix scoring likelihood against severity, which sorts hazards into those to design out, reduce, transfer or simply accept. Its weakness is that it only ever catches what somebody thought to list, it dates quickly when processes or suppliers change, and it can decay into a signed form nobody reads. Done properly it shows up in the numbers as fewer lost time accidents, lower premiums and less downtime; done badly it buys cost and false confidence.

Prevention changes the odds before anything goes wrong, and the three examples in this part of the course map neatly onto the three families of control. Physical controls such as sprinklers, fire doors and machine guards cut the severity of an incident and often cut the insurance premium enough to part fund themselves. Technical controls such as off site or cloud copies of data, with a restore that has actually been tested, turn a ransomware attack or a server failure from a closure into a few hours of lost work. People controls such as induction, manual handling and cyber awareness cut the frequency of the mistakes that cause most claims. Each carries a certain cost now against an uncertain saving later, which makes the decision a payback style judgement, and training only repays the firm if labour turnover is low enough for it to keep the people it has trained.

The dividing line is whether a loss can be priced. An insurer needs a large pool of similar exposures, a loss that can be measured in money, and a pure hazard, meaning one that can only go wrong and never right. Fire, theft, vehicle damage, goods in transit, public liability and employer liability all pass that test, and employer liability cover is compulsory for firms with staff in the United Kingdom. Speculative business risks fail it because the same decision that can lose money can also make it, which covers a rival cutting prices, a product launch that flops, a recession, a change in taste and damage to reputation. No premium is quoted for those, so the firm carries them itself through reserves, diversification and flexible capacity. Insurance converts an unpredictable large loss into a known annual cost, but only for part of the risk register.

Two related activities, separated by timing. The first is anticipatory: before anything happens the firm asks what if, writes down the trigger, the response, who leads it and where the money comes from, then rehearses it. The second is reactive: once the event is live, a named team takes control, protects people first, restores operations and speaks publicly with one voice. A good plan makes the second job shorter and cheaper because the hard decisions were taken calmly in advance. The fried chicken chain that switched delivery partner in the United Kingdom in the spring of two thousand and eighteen closed most of its restaurants for days, and was judged largely on how it communicated. The trade off is cost, since writing, testing and updating plans absorbs management time for events that may never arrive, so small firms plan only for their worst scenarios.

Each of the four levers buys resilience and each costs something, and the marks are in that trade off. A reserve of cash, often set as a stated share of turnover or of a project budget, is available on demand but earns almost nothing, so it drags on return on capital employed while it sits there. A second supplier, a mothballed line, spare capacity or a subcontractor on standby shortens an interruption but raises unit costs and lowers capacity utilisation, which is actual output divided by maximum possible output multiplied by one hundred. Deciding in advance who is in charge removes the argument at the worst possible moment, and only works where deputies are named and the plan is rehearsed. Handling the public side with one trained spokesperson, fast honest updates and a visible remedy protects the brand, which is the slowest asset to rebuild.

There are only four things a firm can do with a threat: accept it and absorb the loss, reduce it with controls, shift it to somebody else through insurance or a contract clause, or stop the activity that creates it. Plotting each hazard on a likelihood and impact grid usually decides which one applies, so rare but catastrophic events are transferred, frequent but minor ones are reduced, trivial ones are tolerated, and a hazard that is both likely and severe puts the activity itself in question. A strong answer then tests the choice against the firm objectives, cash position, size and appetite for risk, and against the time horizon, because a fast growing firm may rationally accept exposures a mature one would insure. The counter worth making is that over controlling raises fixed costs and slows decisions, and some risk taking is what earns the return.

This work is judged by who it protects and at what price. Employees gain safer workplaces and more secure jobs; customers gain continuity of supply and safer products; suppliers gain stable orders and a buyer still able to pay after a shock; lenders and insurers price a well controlled firm more cheaply, which shows up in both gearing costs and premiums; owners gain protection of asset value and a smoother earnings stream, and markets punish surprises more harshly than known problems. Against that sit the cash cost, the management time, and the danger that a thick document creates false confidence in scenarios nobody ever rehearsed. The conflict worth writing about is short term profit against long term resilience, and the judgement turns on sector, size and exposure, since a chemical plant and a two person consultancy are not making the same decision.