Jane said that she couldn't tolerate the long hours.

(a) (i) Roles of a risk manager
Providing overall leadership, vision and direction, involving the establishment of risk management (RM) policies,
establishing RM systems etc. Seeking opportunities for improvement or tightening of systems.
Developing and promoting RM competences, systems, culture, procedures, protocols and patterns of behaviour. It is
important to understand that risk management is as much about instituting and embedding risk systems as much as
issuing written procedure. The systems must be capable of accurate risk assessment which seem not to be the case at
H&Z as he didn’t account for variables other than impact/hazard.
Reporting on the above to management and risk committee as appropriate. Reporting information should be in a form
able to be used for the generation of external reporting as necessary. John’s issuing of ‘advice’ will usually be less useful
than full reporting information containing all of the information necessary for management to decide on risk policy.

Ensuring compliance with relevant codes, regulations, statutes, etc. This may be at national level (e.g. Sarbanes Oxley)
or it may be industry specific. Banks, oil, mining and some parts of the tourism industry, for example, all have internal
risk rules that risk managers are required to comply with.
[Tutorial note: do not reward bullet lists. Study texts both use lists but question says ‘describe’.]
(ii) John Pentanol’s understanding of his role
John appears to misunderstand the role of a risk manager in four ways.
Whereas the establishment of RM policies is usually the most important first step in risk management, John launched
straight into detailed risk assessments (as he saw it). It is much more important, initially, to gain an understanding of
the business, its strategies, controls and risk exposures. The assessment comes once the policy has been put in place.
It is important for the risk manager to report fully on the risks in the organisation and John’s issuing of ‘advice’ will usually
be less useful than full reporting information. Full reporting would contain all of the information necessary for
management to decide on risk policy.
He told Jane Xylene that his role as risk manager involved eliminating ‘all of the highest risks at H&Z Company’ which
is an incorrect view. Jane Xylene was correct to say that entrepreneurial risk was important, for example.
The risk manager is an operational role in a company such as H&Z Company and it will usually be up to senior
management to decide on important matters such as withdrawal from risky activities. John was being presumptuous
and overstepping his role in issuing advice on withdrawal from Risk 3. It is his job to report on risks to senior
management and for them to make such decisions based on the information he provides.

(b) Criticise John’s advice
The advice is based on an incomplete and flawed risk assessment. Most simple risk assessment frameworks comprise at least
two variables of which impact or hazard is only one. The other key variable is probability. Risk impact has to be weighed
against probability and the fact that a risk has a high potential impact does not mean the risk should be avoided as long as
the probability is within acceptable limits. It is the weighted combination of hazard/impact and probability that forms the basis
for meaningful risk assessment.
John appears to be very certain of his impact assessments but the case does not tell us on what information the assessment
is made. It is important to recognise that ‘hard’ data is very difficult to obtain on both impact and probability. Both measures
are often made with a degree of assumption and absolute measures such as John’s ranking of Risks 1, 2 and 3 are not as
straightforward as he suggests.
John also overlooks a key strategic reason for H&Z bearing the risks in the first place, which is the return achievable by the
bearing of risk. Every investment and business strategy carries a degree of risk and this must be weighed against the financial
return that can be expected by the bearing of the risk.
(c) (i) Define ‘entrepreneurial risk’
Entrepreneurial risk is the necessary risk associated with any new business venture or opportunity. It is most clearly seen
in entrepreneurial business activity, hence its name. In ‘Ansoff’ terms, entrepreneurial risk is expressed in terms of the
unknowns of the market/customer reception of a new venture or of product uncertainties, for example product design,
construction, etc. There is also entrepreneurial risk in uncertainties concerning the competences and skills of the
entrepreneurs themselves.
Entrepreneurial risk is necessary, as Jane Xylene suggested, because it is from taking these risks that business
opportunities arise. The fact that the opportunity may not be as hoped does not mean it should not be pursued. Any
new product, new market development or new activity is a potential source of entrepreneurial risk but these are also the
sources of future revenue streams and hence growth in company value.

(ii) Critically evaluate Jane Xylene’s view of risk management
There are a number of arguments against risk management in general. These arguments apply against the totality of risk
management and also of the employment of inappropriate risk measures.
There is a cost associated with all elements of risk management which must obviously be borne by the company.
Disruption to normal organisational practices and procedures as risk systems are complied with.
Slowing (introducing friction to) the seizing of new business opportunities or the development of internal systems as they
are scrutinised for risk.
‘STOP’ errors can occur as a result of risk management systems where a practice or opportunity has been stopped on
the grounds of its risk when it should have been allowed to proceed. This may be the case with Risk 3 in the case.
(Contrast with ‘GO’ errors which are the opposite of STOP errors.)
There are also arguments for risk management people and systems in H&Z. The most obvious benefit is that an effective
risk system identifies those risks that could detract from the achievements of the company’s strategic objectives. In this
respect, it can prevent costly mistakes by advising against those actions that may lose the company value. It also has
the effect of reassuring investors and capital markets that the company is aware of and is in the process of managing
its risks. Where relevant, risk management is necessary for compliance with codes, listing rules or statutory instruments.