## Learning Outcomes

After reading this article, you will be able to explain how risk affects organisational performance, identify and assess business risks, and recommend appropriate risk management strategies. You will understand common risk response techniques and be able to evaluate how risk appetite influences decisions. You should also be able to apply these principles to ACCA APM exam scenarios.

## ACCA Advanced Performance Management (APM) Syllabus

For ACCA Advanced Performance Management (APM), you are required to understand how risk affects planning, decision-making, and reporting of performance at all organisational levels. You must be able to:

- Identify and evaluate the impact of business risk and uncertainty on performance measurement and management systems
- Apply and assess methods for risk identification and assessment in strategic planning
- Recommend and justify appropriate risk responses, including the use of management controls and strategic decision rules
- Analyse the effect of varying stakeholder risk appetites on business decisions and performance reporting

## Test Your Knowledge

_Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, look more closely at that area during your revision._

1. In risk management, what is the difference between a risk and an uncertainty?
2. Which of the following is NOT a typical risk response?
   a) Avoidance
   b) Reduction
   c) Exploitation
   d) Documentation
3. Explain the term "risk appetite" and how it influences strategic decisions in performance management.
4. A company faces a risk of supply chain disruption. What steps could it take to identify, assess, and respond to this risk?

## Introduction

Effective performance management depends on understanding and managing risk. All organisations face uncertainties that can impact their objectives and overall success. Risk management is not just about preventing disasters; it is also about recognising opportunities. This article covers the processes of risk identification, assessment, and response, and explains how these fit into planning, decision-making, and performance management for ACCA APM candidates.

> **Key Term: Risk**
> The possibility that an event will occur and negatively affect achievement of organisational objectives.
> **Key Term: Uncertainty**
> The state of having limited knowledge about future outcomes, including unknown probabilities or effects.
>
> **Test Tip:**
> When revising Identification assessment and responses, connect each definition, method, or rule to the kind of question the assessment is likely to ask.

### Risk Identification

The first step in risk management is to systematically identify potential risks facing the organisation. These may be internal or external, strategic or operational, and may affect all areas of performance.

### Methods for Risk Identification

- Brainstorming sessions with management teams
- Reviewing past incidents and lessons learned
- SWOT analysis (Strengths, Weaknesses, Opportunities, Threats)
- PESTLE analysis (Political, Economic, Social, Technological, Legal, Environmental)
- Analysis of supply chains, processes, and systems

Key risks can include changes in market demand, competitor actions, economic shifts, regulatory changes, operational failures, or technology disruptions.

### Worked Example 1.1

A retail chain is dependent on a single IT system for all its transactions. What risks can be identified from this reliance?

> **Answer:**
> The business faces risks such as system failure (operational risk), data breaches or cyber-attacks (security risk), and supplier risk if the IT provider fails. There may also be strategic risk if competitors use more advanced systems.

### Risk Assessment

Once risks are identified, they must be assessed in terms of likelihood (probability) and potential impact on organisational objectives.

![Risk response decision path distinguishing threats and opportunities, linking risk appetite to avoidance, mitigation, transfer, acceptance with contingency, exploitation, and monitoring.](https://static.pastpaperhero.com/images/acca-apm-risk-management-and-performance-impact-identification-assessment-and-responses_00.png)

_Identified risks are classified by nature and appetite, with responses of avoidance, reduction, transfer, acceptance, or exploitation followed by monitoring._

> **Key Term: Risk Assessment**
> The process of evaluating identified risks to estimate their probability and impact on performance.

Risks are often mapped on a risk matrix, such as:

- High probability, high impact (priority action)
- Low probability, high impact (monitor and plan)
- High probability, low impact (manage with controls)
- Low probability, low impact (review periodically)

Quantitative tools include scenario analysis, sensitivity analysis, and simulation models, especially useful for strategic decision-making under uncertainty.

### Worked Example 1.2

An airline identifies fuel price volatility as a risk. How should it assess this risk?

> **Answer:**
> The airline would estimate the probability of fuel price changes using market data, then model the financial impact on costs and margins. Sensitivity analysis can be used to assess how profit will alter under differing fuel price scenarios.

### Risk Appetite and Tolerance

> **Key Term: Risk Appetite**
> The level and type of risk an organisation is willing to accept in pursuit of its objectives.
> **Key Term: Risk Tolerance**
> The specific maximum amount of risk an organisation is prepared to bear in a given context.

Risk appetites differ among stakeholders. For example, shareholders might tolerate higher risks for growth, while regulators demand lower risk for public safety. Performance targets and incentives must align with the organisation’s risk appetite to avoid conflicts or unintended behaviours.

### Worked Example 1.3

A not-for-profit healthcare provider is offered a lucrative clinical service that carries significant patient safety concerns. The board is risk averse regarding patient care. What should the organisation do?

> **Answer:**
> Given the board’s risk appetite, the organisation may decide not to proceed with the service, or to introduce strict controls to reduce risk to acceptable levels.

### Risk Response Strategies

After assessment, the organisation must choose how to respond to each risk.

> **Key Term: Risk Response**
> Actions taken to address identified risks, aiming to reduce threat or exploit opportunity.

Common risk responses:

- **Avoidance:** Change plans to eliminate the risk entirely
- **Reduction (Mitigation):** Take actions to minimise likelihood or impact
- **Transfer:** Shift risk to another party, e.g., through insurance or outsourcing
- **Acceptance:** Consciously decide to tolerate the risk, often with contingency planning
- **Exploit (for opportunities):** Take action to ensure a favourable uncertain event occurs

### Worked Example 1.4

A manufacturer identifies the risk of a key supplier failing. What response options are available?

> **Answer:**
> The company could find alternative suppliers in advance (reduction), purchase insurance for supply chain interruption (transfer), build up inventory reserves (mitigation), or accept the risk if it is low and difficult to avoid.
>
> **Exam Warning:**
> In the APM exam, avoid assuming that transferring risk (such as through insurance) always eliminates it. Be aware that some residual risk always remains, and transferred risks can also generate new risks (e.g., insurer default).

### Risk Management and Performance Impact

Managing risk is central to delivering consistent performance. Failure to identify and assess risk can lead to missed targets, budget overruns, or even organisational failure.

Performance management should:

- Set risk-informed targets and KPIs
- Monitor for early warning signs of risk events
- Align reward systems with both performance and risk control
- Ensure reporting systems track both financial and non-financial risks

Scenario planning and regular board-level risk reviews are key to maintaining effective oversight.

## Summary

Risk management is about identifying, assessing, and responding to uncertainties that influence organisational objectives. Proper risk responses, guided by clear risk appetite, connect strategic planning and daily decision-making, supporting effective performance management.

## Key Point Checklist

_This article has covered the following key knowledge points:_

- Define and distinguish risk, uncertainty, risk appetite, and risk tolerance
- Identify and assess risks using appropriate models and tools
- Explain risk mapping and common assessment techniques
- Recommend risk response strategies (avoid, reduce, transfer, accept, exploit)
- Analyse the impact of risk on performance management and reporting systems
- Understand the importance of aligning risk appetite with organisational objectives

## Key Terms and Concepts

- Risk
- Uncertainty
- Risk Assessment
- Risk Appetite
- Risk Tolerance
- Risk Response


Risk management and performance impact - Identification assessment and responses