Tesco Plc: Developing and Evaluating Risk Management Strategies Report

This report provides a comprehensive analysis of risk management strategies, focusing on their application within Tesco Plc, a major retail organization. The report begins by defining risk management and its importance to an organization, followed by an examination of the roles and responsibilities of senior management in this area. It then evaluates various risk management models, including Enterprise Risk Management (ERM) and Integrated Risk Management (IRM), assessing their advantages and disadvantages in the context of Tesco's operations. The report delves into risk assessment criteria, exploring techniques for identifying and quantifying risks, and developing strategies for their elimination, mitigation, and acceptance. Furthermore, it outlines processes for communicating, resourcing, and managing risk management strategies, evaluating their outcomes and determining actions to respond to them. A key component of the report is the development of a disaster recovery plan, alongside an examination of factors that could influence its review. The report concludes with a summary of findings and recommendations for Tesco Plc.

Developing Risk
Management Strategies

Table of Content
INTRODUCTION...........................................................................................................................1
TASK 1............................................................................................................................................1
1.1 Meaning of risk management to an organisation...................................................................1
1.2 Roles and responsibilities for risk management at senior management level.......................2
1.3 Evaluate risk management models........................................................................................3
TASK 2............................................................................................................................................3
2.1 Risk management criteria against which risk can be assessed..............................................3
2.2 Critique techniques to identify and quantify risk, including risk interdependencies............4
TASK 3............................................................................................................................................5
2.3 Develop strategies to eliminate, mitigate, deflect or accept risk...........................................5
2.4 Determine a process for communicating, resourcing and managing risk management
strategies......................................................................................................................................7
TASK 4............................................................................................................................................8
3.1 Evaluate the outcomes of risk management strategies..........................................................8
3.2 Determine actions to respond outcomes of risk strategies.....................................................9
TASK 5..........................................................................................................................................10
3.3 Devise a disaster recovery plan...........................................................................................10
3.4 Examine influences that would affect a review of disaster plan.........................................12
CONCLUSION..............................................................................................................................12
REFRENCES.................................................................................................................................14

INTRODUCTION
Risk management is the procedure of identifying, assessing and controlling threats to an
company's capital as well as earning. These risk or threats could based from wide variety of
sources which involve legal liabilities, financial uncertainty, strategic management errors, any
natural disaster and so on (Sameh Monir El-Sayegh, 2007). Moreover, risk management
strategies are designed within organisation for controlling as well as managing present or future
risk through which organisation may suffer. This assignment is based on TESCO Plc. Which is
an retail industry organisation founded in 1919 and its founder is Jack Cohen. They are serving
in UK, Ireland, India, Malaysia, Thailand, Czech Republic and Hungary. Products offering by
them are supermarket, hypermarket, superstores and convenience shop.
Below mention report is going to explain meaning of risk management for TESCO Plc. As well
as senior manager role and role within the same. strategy and analyse if it is fit for purpose for
the organisation. Identification of potential risks and strategies to eliminate, mitigate, deflect or
accept the risks are essential aspects of the responsibility. A detailed analysis, identification and
mitigation of various risks that an organisation can possible undertake as a vital exercise.
This will also require highlighting different risk management techniques in use now-a-days. A
systematic approach of risk management, handling risks. Neglection of risk without taking
that into in its context can turn a potentially profitable organisation to a loss-making strategy.
TASK 1
1.1 Meaning of risk management to an organisation
Risk is the effect of uncertainty on organisation’s objectives. This can be perceived
either positive (opportunity) or negative (threat). Organisation increasingly focus on
identifying and managing risks before they even affect the business. Risk management has
helped organisation to refrain from making business judgements that are set in stone. Now,
organisation have renewed focus in managing risk.
Organisation acts confidently on future business decisions once the ability to manage
risk is set as a priority. This gives various options to the organisation on how to deal with
identified and potential problems.
1

Risk comes from both internal and external sources. The organisation external risks
are those that are not under the control of the management. These include: Political issues,
interest rates, and exchange rates etc. Contrary to Internal risks these include: Non-compliance
or information breaches, and several others.
Without risk management, the organisation will lose its direction and cannot possibly
define its objectives for the future. Failure to address these uncertainties may result in
organisation failing to achieve its strategic objectives (Comptroller and Auditor General,
2007).
1.2 Roles and responsibilities for risk management at senior management level
Risk management team is separate as well as independent unit within an organisation
which is headed by the risk manager or chief risk officer. This overall team develop strategies for
identifying risk, apply risk management strategies and its analysis tool (Comptroller and Auditor
General, 2008). There are several roles and responsibility for risk management at senior
management level :- Admit and identify – In an organisation implementation of each and every activity
involves some degree of risk with them as well as uncertainness related to future events.
Thus, in this situation risk manager of TESCO Plc. Have to firstly acknowledge as well
as identify them. Some of the threats are generic and inherent in the carrying out of
project so virtually any activity involve risk to fail. Thus, before implementing any type
of project in the working risk Manger of TESCO Plc. Have to identify threats which are
involved in it. Measure and Prioritize – Role and responsibility of risk manger is to evaluate
probability of risk occurrence as well as have to estimate its possible impact on the
overall working. So that, TESCO Plc. Can develop their backup plan in advance for
future threat. Create contingency plan to manage crises – As it has been discussed that risk is
uncertain so it is duty of risk management department within TESCO Plc. That they
have to develop contingency plan for managing risk. So that it will not effect
profitability as well as activities of the respective organisation.
 Evaluate employees risk awareness and train them when necessary – It is
responsibility of risk management team within TESCO plc. To provide risk awareness
2

program to staff members. Along with the, training session also if it is required so that
personnel can handle uncertainty in effective manner as well as result in minimising loss
for business.
1.3 Evaluate risk management models
Enterprise risk management model is based on international practices through which
organisation like TESCO Plc will manage current and potential threats. Respective system
involve Moncler's governance bodies, each acting among the scope of its respective competence.
Major aim behind developing risk management tool is to make sure effective identification,
measurement, management as well as monitoring of risk (Pettit, Fiksel and Croxton, 2010) . The
respective model covers every type of threats which can possibly impact on the accomplishment
of strategic objectives, impair company assets and undermine the value of the Brand. ERM is
integrated into strategic decisions as well as key decision- making procedure. Moncler’s ERM
model has been classified risks within four categories: Strategic risk – It is related alteration in organisation or to inadequate response to
changes in the business environment full of competition. For stance, sustainability is kind
of threat which fall under the category strategic risk. Business risk – It is the threat related of particular sector as well as the area in which
organisation is operating (Tang and Musa, 2011). Business support risk – There are several supporting activities for an organisation such
as structure, controlling process, IT and reporting system. Risk involve in this are related
to business support risk.
 Compliance risk – These are threats related to business conduct as well as related to
breach of laws and regulation which are applicable for organisation at national and
international level.
Advantages of Moncler’s ERM model – Business environment is full of several risk which can
be identified as well as reduce with the assistance respective model. Along with this, it is also
suitable for preventing losses, damage as well as any injury within working area.
Disadvantage of Moncler’s ERM model – It is continuous process which result in extra
expenses because TESCO have to set permanent risk management team so they can work
continuously and save business from any hazards.
3

Apart from this, another model is IRM (integrated risk management) which is set of
practices as well as procedure supported through risk aware culture and enabling technology
which develop design making or performance by an integrated view that how an company
manage set of risk in unique manner. IRM have certain attributes are as follows :-
 Strategy- Implementation of framework which involve performance improvement by
effectual governance as well as risk ownership.
 Assessment- Evaluation, identification and prioritization of hazards.
 Response- After identification of risk such mechanisms will be implement that result in
reducing risk.
 Communication and reporting- In the risk will be communicated to stakeholders of the
organisation for gaining proper response.
 Monitoring- Determination and implementation of procedure which methodically track
governance objectives, risk accountability, compliance with policies and decisions which
are set by using governance procedures for the effectiveness of risk reduction.
 Technology- Designing and implementation of Integrated Risk Management solution.
Advantage of ERM model- Through this model TESCO can create risk focus culture in the
organisation for its identification. Thus, by implementing IRM model risk will be determined in
effective manner along with its solution.
Disadvantage of ERM model- Implementation of respective model is Time consuming as well as
expensive process because there is requirement of hiring professional team for risk management
purpose within TESCO.
Moncler’s ERM model is most suitable for Tesco because with the assistance of it they
can find different type of risk which may result in any loss for business. This model is more
suitable, because strategies related to every risk has been designed in advance so that there is no
need to take instance step while risk occur.
Another model that could be used by organisations in managing the risks attached to a
project is the Gantt Chart. With the help of this chart model, the company could illustrate the
schedule of the project such as about the activities related to the project such as when to do what
work and with the help of which material. This helps in reducing the risks related to time, cost
and money for the company. The following model could be applied not only in the small projects
but also in the big projects also.
4

For the maintenance of projects in an organisation, there are many benefits that could be
availed by an organisation in order to make the successful completion of the project on which the
company is working. The first benefit is related to the representation of the project and schedules
which is very easy for the companies to understand what are the activities to be performed by
them. The milestones could be easily represented, sub tasks, tasks and projects visually on the
graph could be easily represented with the help of Gantt Chart. On the other hand, there are also
some disadvantages of using this model for the projects because it is very difficult to update the
chart in case the company needs to make any changes in the project. In addition to this, another
reason for the disadvantage is because of non visibility of tasks in the single view of a Gantt
Chart.
TASK 2
2.1 Risk management criteria against which risk can be assessed
TESCO is retail sector organisation and there are some risk related to the same area
which affect its working. Financial is one of the major hazard for business and it may affect
entire working of respective firm. There are some risk management criteria which have to
implement by TESCO so that hazards of financial can be minimise. Explanation of these are as
follows:-
 Risk avoidance – TESCO is facing financial risk so for avoiding it, they should not have
to invest in such resources which result as an hazard for respective business. Thus,
company have to avoid risk related to finance. Advantage of risk avoidance is that
company can avoid hazards which may harm their working. But as respective
organisation is going through financial risk and to overcome with this they avoiding
investment which may result in no such future gains.
 Risk Reduction – It is the strategy which utilise by TESCO for dealing with risks which
involves some measures for reducing hazards level. Advantage of respective is that it
help in dealing with hazards and minimising their impact within organisation.
 Risk transfer – TESCO can transfer their risk by using insurance organisation or risk
managements pools. Thus, insurance result in covering property damage or loss, covers
losses related to a government being found negligent in the performance of operations.
Apart from this, Workers compensation provides employees with coverage for all
5

medical bills resulting from job-related injuries or disabilities as well as lost income.
Company gain advantage with this as they can transfer risk and generate revenue as per
requirement.
 Risk Retention – In this, special contingencies funds are created to overcome with the
risk related to finance. It is necessary because financial risk may result in negative impact
on work TESCO.
 Risk Profiling - It will estimate capability of TESCO in relation to financial risk taking
as well as understanding hazards tolerance level of staff members. Major advantage
respective organisation gain through risk profiling is that employees risk handling level
will identified as well as increase.
 Risk Awareness: The following criteria will provide the company with the possible risk
that could be faced by Tesco in the near future regarding any work on which the company
is working on.
With the help of these risk identification or assessment criteria it will be possible for the
companies to make proper identification of the risks that are attached with the business. Gantt
Chart could make the company aware about the possible risks that could arise during the course
of completing the project or work as there are possibility of deviations that could occur in the
work. The risks presented in the Moncler's Model could also be assessed. Risk reduction and risk
avoidance could help the Tesco in reducing and avoiding the possible risks for the company.
There are many risks that could be faced by an organisation such as risks related to the
implementation of strategies, evaluation, identification and prioritization of risks. The company
could earlier predict about the risks that are attached with the work or project than preventive
measures could be adopted by them in order to reduce the impact of those risks which could
impact negatively on the working of the company.
2.2 Critique techniques to identify and quantify risk, including risk interdependencies
There are numerous way to identify, quantify and interdependencies risk. There are two
specific techniques that used to identify quantity of risk as -
Technique Description Weakness Strength
SWIFT It is basically a
structured
SWIFT isn't
comprehensive and it
This technique is
flexible and compared
6

brainstorming
technique which is
more quicker, flexible
and assist in finding
high risks. Some pre-
developed guide-
words are used in it
along with phrases like
“what if”.
is not an effective
technique in case of
isolation.
to other techniques and
it is much quicker
compared to other
techniques.
Brainstorming Brainstorming is done
with a group of
people who focus on
identification of risk
for the project.
Allows all participants
to speak their mind
and contribute to the
discussion
Can involve all key
stakeholders
Creative generation of
ideas
Requires attendance
of key stakeholders
at a workshop,
therefore can be
difficult to arrange
and expensive
Prone to Groupthink
and other group
dynamics
May produce biased
results if dominated
by a strong person
(often management)
Often not well
facilitated
Generates non-risks
and duplicates,
Critique of methods - Brainstorming is less structured compared to SWIFT as the later
one follows a fixed procedure while the prior one does not have an organised system. SWIFT is
more flexible because questions like “what if” are important part of this technique but even after
this flexibility, it is better structured. As for SWIFT is more suitable technique because it help
them in managing risk within effective manner. This is flexible in nature so if their will
7

requirement of modification then easily it can be done. Apart from this, reason behind not
selecting brainstorming is because it is less structured as compare to SWIFT as well as not
flexible in nature.
Explanation of other techniques are as follows:- Documentation reviews – This is an standard practice through which TESCO Plc can
identify risk by reviewing documents related to project like lessons learned, articles,
organisational process assets and so on. Probability and impact matrix – This assist in identifying those threats who need
immediate response. Respective matrix can be customized as per the requirement of
project. Moreover, many organisation have an standardized format of the respective
matrix as well as project manager can leverage those templates as well. Although,
utilisation of standardized matrix makes matrix list more repeatable within projects. Monte Carlo Simulation – This risk quantifying technique simulates cost or schedule of
the project. Primary input for quantifying risk in Monte Carlo analysis is network
diagram as well as estimation of the performance. A Monte Carlo analysis :- computer
based program, evaluates the overall risk in the project, path convergence are consider,
cost and schedule impacts can be assessed as well as results in a probability distribution.
 Risk register – It is the most common tool use for tracking as well as managing risk of a
project. Risk register involve identification of threats, their mitigation strategies,
brainstorming session and so on. This is also known as risk log as well as it becomes
necessary part in threats quantifying because it records identified risks, their severity, and
the actions which will be taken (Lam, 2014). Moreover, risk register is simple document,
spreadsheet, or a database system but most suitable format of this is in tabular form
because a table presents a great deal of information in just a few pages.
Above mention are the techniques through which TESCO Plc can identify, quantify and
interdependencies risk. Because it is necessary to identify threats so that there will no chances of
present and potential loss within respective organisation.
8

TASK 3
2.3 Develop strategies to eliminate, mitigate, deflect or accept risk.
There are several risk associated with the TESCO such as finance, Technology,
modification in customers need and wants, data breach (Iglesias and et. al., 2009). All these
required to be handle in proper manner by developing strategy for eliminating, mitigate, deflect
as well as accept risk. Explanation of these are as follows :-
 Eliminate – Financial risk can be eliminate by its outsourcing to the third party who can
manage outcomes. This is done financially through insurance contracts or hedging
transactions, or operationally through outsourcing an activity. This is the best source
through which financial risk can be eliminated and TESCO gain advantage through this
by minimising any type of hazard on investment.
 Mitigate – Risk related to technology can be mitigate because it is easiest to understand
as well as implement. In TESCO there are several type of technological risk which need
to be mitigate because such hazards can be easy to understand as well as organisation can
come out with these in easy manner.
 Deflect – Data breach should be deflect by organisation because TESCO can change their
data storage settings for avoid risk. Because respective hazard may give wide impact on
working of organisation so it is necessary to deflect risk and modify existing strategy to
minimise its future chances. Risk related to data storage can be deflect by company
because they can minimise such effects through changing their data storage setting.
 Accept – Modification in customers need and want is risk which has been accepted by
TESCO because it is small hazards through that company can easily recover. By
accepting this organisation can do innovation in their existing offering or bring something
new which satisfy need and want of customers. For TESCO, chance in customer needs
and want is also risk which is accepted by them. Because such risk can be cover easily as
well if company will able to fulfil their customers requirement and make them satisfy.
Then such practices will result in increasing sales and gaining long term profitability.
The strategies in relation to the facing the risks by an organisation such Tesco is in three
steps which are Identification of Risks, Analysing the Risks and Evaluating the Risks. With the
proper implementation of these risk criteria, it will be easy for the companies to make their focus
over the main issues that are impacting upon the working of the company and impacting the
9

results of the project or the task which the company is carrying out. These strategies will help the
company in knowing about the various types of issues and risks that could be confronted by the
company.
The answer to these questions will prevent the company from being covered with
unwanted losses such as prevention from the financial risks, operations risks, investment risks
and some other risks are also covered under this part. In addition to this, the acceptance of risk
will also provide the companies with the experience of dealing with the various types of
situations that could be confronted by them during the process of the dealing with the risks. In
future also, this will help in dealing with these kinds of situation by knowing the reason of their
occurrence and how to deal with these kind of situations.
Description Likelihood
and impact
Detection
how will we
know it has
happened
Immediate
action
Later
action
Effect on
Users
Mitigation
and
contingency
(Currently
in place)
Financial
risk
Medium Monitoring
financial
activities
Evaluate the
financial
record
Monitor and
analysis
entire entry
related to
financial
activities
No effect Monitor
financial
record
Technologic
al risk
Low Evaluating
technologies
Update
technologies
No letter
action
necessary
No effect Needs to
update all
the
innovative
technology
Data storage Low Analysing
storage of
data
Restore data Update
software
Users will
not have
access to
data
Monitor
storage
software
10