QUESTION 1 A theatre has planned and published its programme for the upcoming performance season. In the programme, there are two flagship performances. One features an internationally acclaimed solo musician and one is by a renowned ballet company. The theatre relies heavily for income on these two performances and wants to ensure that they maximise bookings and minimise risks that might prevent the performances from going ahead. Traditionally, the theatre is au fair with compliance risks, hazard risks, control risks and speculative risks. As is customary, it has contacted those on its mailing list and has issued programmes and booking instructions in both paper format and via email, as a link to its website and a pdf document. Those who are members of the theatre have been given preferential booking rights and a window for booking ahead of the general public. The booking period for the general public has been clearly stated on the programme and theatre staff are ready to take bookings. Given the importance placed on the two specific performances, a management meeting has been scheduled where the risk manager has been invited to facilitate a discussion to identify the most important threats, their mitigating controls and help management to put together an action plan to address any risks that have not been mitigated to an appropriate level. The theatres risk appetite for these risks is low. Any risk that has a higher residual impact or likelihood than this should be considered outside of appetite and further mitigating actions considered. The meeting is not considering positive, upside risks today. The Risk and Audit Committee is also seeking assurance that all of the significant risks are being adequately managed and that all of the critical controls are effective and that they have been efficiently implemented. To achieve this, following the workshop, the risk manager has compiled a risk impact matrix based on the residual risk assessment to review the resulting risk exposure for the theatre. The risk manager used the following risk register format to facilitate the discussion. Risk Description Risk Type Control Description Control Type Residual Risk Impact Action Plan Required; a. What types of risks are management looking to mitigate at their meeting? (1 Mark) b. The risk manager asks management to classify the risk identified by type of risk. Column 1 below is the list of risks identified. For each risk in column 1, select from Column 2 the 3 types of risk that refers to it. Each selection from Column 2 can be used once, more than once or not at all. (2 Marks) Column 1 Risk Description Column 2 Types of Risk 1. Power Cut 2. Absence of key performer 3. Substantial transport failure or road closures that delay the arrival of the audience or the performers 4. Health and safety issues causing the closure of the theatre 5. Lack of bookings making the performance unviable. A. Compliance B. Hazard C. Control D. Speculative c. The risk manager moves on to the categorization of control type for each identified control below. Column 1 is the lists of controls identified. For each control in column 1, select from column 2, the control type that refers to it. Each selection from column 2 can be used once, more than once or not at all. (2 Marks) Column 1 Control Description Column 2 Control Type 1. Power generator in place and tested 2. Backup plan for individual performer 3. Incident management and response plan 4. Periodical Health and Safety Assessment 5. Distributing a discounts plan to enhance bookings. A. Directive B. Detective C. Preventative D. Corrective d. In response to the Risk and Audit Committees request, what activities are designed to provide independent assurance over the control environment? (2 Marks) 4 1. Substantial transport failure or road closures 3. Power Cut 4. Health and safety issues causing the closure of the theatre 2. Absence of a key performer 5. Lack of bookings making the performance unviable Impact Likelihood e. Which risks are potentially outside of managements risk appetite based on the diagram above? (1 Mark) f. What does the distribution of risks tell the reader? (2 Marks) g. What is an upside risk? What other name can be given to such a risk? (1 Mark) h. What FIVE tests does the Institute of Risk Management say directors should test when reviewing their organisations risk appetite framework? (3 Marks) i. Define each of the following, and indicate the hierarchy in which they occur: Risk tolerance, Risk universe and Risk appetite and Risk capacity? (3 Marks) j. What SIX key principles do risk experts say underpin any work on risk appetite? (3 Marks) (Total = 20 Marks)