Risk Identification & Taxonomy

Part 1: How to Find Risks - Identification Techniques

Risk identification is the first active step in the risk management process. It's a systematic effort to discover the universe of uncertainties that could affect an organization's objectives. A common mistake is to assume this can be done once by a small group; in reality, it must be a comprehensive and continuous process.

To get an overview of the landscape of identification techniques, let's watch a video from Dr. David Hillson, the "Risk Doctor".

The video's time-based framework is a powerful way to ensure comprehensive coverage. A process relying only on checklists (the past) will miss novel threats, while one relying only on brainstorming (the future) might forget hard-won lessons.

The following flowchart provides an alternative way to visualize the array of available techniques, grouping them by their source and nature.

Combining Techniques for a Robust View

So, which technique is best? As you might expect, there is no single answer. The most effective approach is to use a combination of techniques that provides a multi-faceted view.

Let's continue with the same video to hear a recommendation for a powerful, yet simple, combination.

The ABC approach is an excellent, practical starting point for any risk identification exercise, as it forces a look backward, a look at the present, and a look forward.

Risk Identification is a Continuous Process

Finally, it's critical to understand that you can never identify all risks at the beginning of a project or strategy. The risk landscape is dynamic.

This is why the Actuarial Control Cycle is a cycle. The "monitoring experience" stage continually feeds back into the process, prompting us to revisit our risk identifications as the environment and our own strategies evolve.

Part 2: How to Organize Risks - Classification and Taxonomies

Once you have a list of identified risks—often generated from brainstorming sessions, interviews, and checklists—you are left with a large, unstructured collection of information. To manage these risks effectively, you must first organize them. This is the goal of risk classification.

A risk taxonomy is a hierarchical classification scheme for an organization's risks. Think of it as the Dewey Decimal System for risk management. Establishing a clear and consistent taxonomy is vital because it:

• Creates a common language for risk across the organization.
• Ensures all significant risks are considered and none fall through the cracks.
• Facilitates the assignment of clear ownership for managing specific risks.
• Enables meaningful aggregation and reporting of risk exposures to senior management and the board.

Let's begin to build this taxonomy with a short video that introduces the highest-level categories.

These three categories, along with Insurance Risk, form the bedrock of most financial institutions' risk taxonomies. The image below provides a common visualization of how these risks are structured.

Now, let's delve deeper into these categories by consulting a more detailed text.

The SOA text provides a comprehensive overview. For an insurer, we must explicitly add Insurance Risk to this framework. This category includes risks inherent to the business of insurance, such as:

• Underwriting or Pricing Risk: The risk that premiums charged are insufficient to cover future claims and expenses.
• Reserving Risk: The risk that provisions set aside for future claims are inadequate.
• Catastrophe Risk: The risk of extreme losses from a single large event (like a hurricane) or an accumulation of many smaller events.

A Special Category: Emerging Risks

A robust identification process must also look for emerging risks—risks that are new or evolving, difficult to quantify, and highly uncertain. These often arise from long-term trends like globalization, technological advancement, or environmental change.

The Covid-19 case study powerfully illustrates the shortcomings of static risk registers and the need for dynamic ERM that can grapple with "black swan" events—those that are rare, have extreme impacts, and seem obvious in hindsight.

Conclusion

In this lesson, we have moved from the "how much" of risk to the "what" of risk. We've seen that risk identification is a structured, continuous process that requires looking to the past (checklists), present (assumptions analysis), and future (brainstorming).

Once identified, risks must be classified into a logical risk taxonomy to ensure a common language and comprehensive management. This taxonomy typically organizes risks into major categories like Financial (Market, Credit, Liquidity), Insurance, Operational, and Strategic. Finally, we recognized the unique challenge of identifying and analyzing emerging risks, such as climate change and cyber threats, which requires forward-looking techniques like horizon scanning.

In our next lesson, we will address the logical next step in the ERM process: risk assessment and measurement. Having identified and classified our risks, we will explore the qualitative and quantitative methods used to answer the question, "How big are these risks?"

Key Takeaways & Cheatsheet

Here is a summary framework of the concepts covered, which will be useful for your exam preparation.

1. Risk Identification Framework (The "How")

• Goal: To create the most comprehensive list of risks possible.
• Core Principle: Use a combination of techniques covering different time horizons.
• The "ABC" Approach:
  • A - Assumptions Analysis: Challenge the certainties in your current plans. (Present-focused)
  • B - Brainstorming: Creatively imagine what might happen in the future. (Future-focused)
  • C - Checklists: Learn from the documented experience of the past. (Past-focused)
• Key Insight: Risk identification is never "done." It is an iterative process that must respond to emerging risks.

2. A Typical Risk Taxonomy (The "What")

This hierarchical structure brings order to the identified risks.

• Financial Risks: Arising from financial markets and transactions.
  • Market Risk: Loss due to changes in market prices/rates (e.g., interest rates, equity prices, FX rates).
  • Credit Risk: Loss due to a debtor or counterparty failing to meet their obligations.
  • Liquidity Risk: Inability to meet cash flow obligations as they fall due.
• Insurance Risks: Inherent to the business of writing insurance contracts.
  • Underwriting & Pricing Risk: Premiums are insufficient for claims and expenses.
  • Reserving Risk: Reserves are insufficient for claims.
  • Catastrophe Risk: Losses from large-scale events.
• Operational Risks: Loss from failed internal processes, people, systems, or from external events.
  • People Risk: Human error, internal fraud, key person leaving, agency risk.
  • Process Risk: Failures in transaction processing or reporting.
  • Systems Risk: IT failure, cyber-attacks, data integrity issues, model risk.
  • External Events: Legal or regulatory changes, political instability.
• Strategic Risks: Failure to achieve strategic business objectives.
  • Competitor Risk: A competitor's actions impair your business model.
  • Reputational Risk: Damage to the brand leads to loss of business.
  • Business Model Risk: Your way of doing business becomes obsolete.