A theatre has planned and published its programme for the upcoming performance season. In the programme, there are two flagship performances. One features an internationally acclaimed solo musician and one is by a renowned ballet company. The theatre relies heavily for income on these two performances and wants to ensure that they maximise bookings and minimise risks that might prevent the performances from going ahead. Traditionally, the theatre is au fair with compliance risks, hazard risks, control risks and speculative risks.
As is customary, it has contacted those on its mailing list and has issued programmes and booking instructions in both paper format and via email, as a link to its website and a pdf document. Those who are members of the theatre have been given preferential booking rights and a window for booking ahead of the general public. The booking period for the general public has been clearly stated on the programme and theatre staff are ready to take bookings.
Given the importance placed on the two specific performances, a management meeting has been scheduled where the risk manager has been invited to facilitate a discussion to identify the most important threats, their mitigating controls and help management to put together an action plan to address any risks that have not been mitigated to an appropriate level.
The theatre’s risk appetite for these risks is low. Any risk that has a higher residual impact or likelihood than this should be considered outside of appetite and further mitigating actions considered. The meeting is not considering positive, upside risks today. The Risk and Audit Committee is also seeking assurance that all of the significant risks are being adequately managed and that all of the critical controls are effective and that they have been efficiently implemented. To achieve this, following the workshop, the risk manager has compiled a risk impact matrix based on the residual risk assessment to review the resulting risk exposure for the theatre.
The risk manager used the following risk register format to facilitate the discussion.
Risk
Description
Risk Type
Control Description
Control Type
Residual Risk Impact
Action Plan
Required;
a. What types of risks are management looking to mitigate at their meeting? (1 Mark)
b. The risk manager asks management to classify the risk identified by type of risk. Column 1 below is the list of risks identified. For each risk in column 1, select from Column 2 the
3
types of risk that refers to it. Each selection from Column 2 can be used once, more than once or not at all. (2 Marks)
Column 1
Risk Description
Column 2
Types of Risk
1. Power Cut
2. Absence of key performer
3. Substantial transport failure or road closures that delay the arrival of the audience or the performers
4. Health and safety issues causing the closure of the theatre
5. Lack of bookings making the performance unviable.
A. Compliance
B. Hazard
C. Control
D. Speculative
c. The risk manager moves on to the categorization of control type for each identified control below. Column 1 is the lists of controls identified. For each control in column 1, select from column 2, the control type that refers to it. Each selection from column 2 can be used once, more than once or not at all. (2 Marks)
Column 1
Control Description
Column 2
Control Type
1. Power generator in place and tested
2. Backup plan for individual performer
3. Incident management and response plan
4. Periodical Health and Safety Assessment
5. Distributing a discounts plan to enhance bookings.
A. Directive
B. Detective
C. Preventative
D. Corrective
d. In response to the Risk and Audit Committee’s request, what activities are designed to provide independent assurance over the control environment? (2 Marks)
4
1. Substantial transport failure or road closures 3. Power Cut 4. Health and safety issues causing the closure of the theatre 2. Absence of a key performer 5. Lack of bookings making the performance unviable
Impact Likelihood
e. Which risks are potentially outside of management’s risk appetite based on the diagram above? (1 Mark)
f. What does the distribution of risks tell the reader? (2 Marks)
g. What is an “upside risk”? What other name can be given to such a risk? (1 Mark)
h. What FIVE tests does the Institute of Risk Management say directors should test when reviewing their organisation’s risk appetite framework? (3 Marks)
i. Define each of the following, and indicate the hierarchy in which they occur:
Risk tolerance, Risk universe and Risk appetite and Risk capacity? (3 Marks)
j. What SIX key principles do risk experts say underpin any work on risk appetite? (3 Marks)
(Total = 20 Marks)