Carrying out an internal risk assessment is a critical responsibility for business management professionals in Kenya. It involves systematically identifying potential internal threats that could disrupt operations, financial stability, or reputation. Understanding how likely a risk is to occur and the potential impact it may have enables managers to prioritize controls and allocate resources effectively. This chapter focuses on two fundamental elements of risk assessment: risk likelihood and impact of risk, equipping professionals to make informed decisions in dynamic business environments.

2.1 Risk likelihood

Assessing the likelihood of a risk involves estimating the probability that a specific risk event will occur within a defined period. In Kenya’s business landscape, where market volatility, regulatory changes, and operational challenges are common, accurately gauging risk likelihood is essential for proactive management. This enables firms such as SACCOs, county governments, and retail enterprises to anticipate disruptions and implement preventive strategies.

2.1.1 Understanding risk likelihood

Risk likelihood refers to the probability or chance that a particular risk event will materialize. It is a forward-looking estimate based on historical data, expert judgment, and contextual factors affecting the business environment. For instance, a bank operating in Nairobi may assess the likelihood of cyber-attacks by analyzing past security incidents and emerging cyber threats.

Components influencing risk likelihood

• Historical frequency: Past occurrences of a risk event provide a baseline for estimating future probability. A cooperative with repeated loan default cases will rate credit risk likelihood higher.
• Internal controls: The presence or absence of effective controls influences how likely a risk is to happen. Strong inventory management in a retail business reduces the chance of stock theft.
• Environmental factors: External elements such as political stability or economic conditions affect risk probability. For example, a county government’s risk of project delays increases during election periods.
• Complexity of processes: More complex or manual processes tend to have higher risk likelihood due to increased chances of errors or failures. An insurance company processing claims manually faces greater operational risk.
• Stakeholder behavior: The actions of employees, suppliers, or customers can raise or lower risk chances. Frequent employee turnover in a hotel may increase the likelihood of service disruptions.

2.1.2 Methods to estimate risk likelihood

Estimating risk likelihood can be qualitative, quantitative, or a hybrid approach depending on data availability and business context. Kenyan businesses often use a combination to balance accuracy and practicality.

Qualitative methods

• Expert judgment: Engaging experienced managers to assess likelihood based on knowledge and intuition, common in SMEs without extensive data.
• Risk matrices: Using a predefined scale (e.g., low, medium, high) to categorize likelihood, facilitating quick prioritization.
• Scenario analysis: Imagining possible future events and estimating likelihood based on their plausibility, useful in strategic planning for universities or hospitals.

Quantitative methods

• Statistical analysis: Using historical data and statistical models to calculate probabilities, suitable for banks or insurance firms with rich datasets.
• Frequency analysis: Counting past occurrences of risk events within a timeframe to infer likelihood.
• Predictive analytics: Employing machine learning tools to forecast risk probability, increasingly adopted by large retail chains.

2.1.3 Challenges in assessing risk likelihood

Risk likelihood assessment faces several challenges that can undermine accuracy and lead to poor decision-making in Kenyan businesses.

Data limitations

Many organizations lack reliable historical data, especially in informal sectors or new ventures, making quantitative estimation difficult. For example, a small farm cooperative may not have records of past pest infestations to assess agricultural risks.

Cognitive biases

Managers may underestimate or overestimate risk likelihood due to optimism bias or recent bad experiences, skewing assessments in financial institutions or county offices.

Dynamic environments

Fast-changing market or regulatory conditions alter risk probabilities rapidly. A hotel’s risk of reduced bookings due to travel bans can shift unexpectedly with new government directives.

Complexity of risks

Interconnected risks complicate likelihood estimation. For instance, supply chain disruptions in a manufacturing firm can cascade into operational delays and financial losses, making isolated likelihood assessments inadequate.

2.1.4 Integrating risk likelihood into decision-making

Risk likelihood must be systematically integrated into risk management frameworks to guide resource allocation and control measures. Kenyan businesses that adopt formal risk registers and scoring systems can track likelihood alongside impact for comprehensive risk prioritization. For example, a county government office can assign likelihood scores to procurement fraud risks and combine them with impact estimates to decide audit frequency.

Chapter Summary

This chapter explored the concept of risk likelihood, explaining how it measures the probability of a risk event occurring within a business environment. It then examined the impact of risk, detailing how the consequences of risks can affect an organization's operations, finances, and reputation. Various types of risks were discussed, including operational, financial, strategic, and compliance risks, to provide a comprehensive understanding of the challenges businesses face. The chapter then focused on developing a risk mitigation action plan, beginning with identifying risk areas where vulnerabilities exist. Assessing the impact of these risks was emphasized to prioritize response efforts effectively. Predicting the likelihood of each risk helped in evaluating their urgency and potential frequency. Finally, the importance of compiling and managing risk data and information was highlighted as essential for informed decision-making and continuous improvement of risk management strategies.