The Universal Risk Model

Abengoa’s Universal Risk Model comprises four categories, twenty sub-categories and a total of ninety-four principal business risks. Each risk has a raft of indicators assigned to it, enabling the company to determine the likelihood of them occurring, their impact and the degree of tolerance towards

12.7

The following diagram illustrates how Abengoa’s Universal Risk Model works. The model is periodically reviewed and updated jointly by the Internal Audit departments, the heads of each area involved and the Risk Management Division:

12.8

After applying both probability and impact indicators, risks are grouped into 4 types, each of which has its own pre-determined risk management strategy:

  • Minor Risk. Arise frequently but have little economic impact. These are managed accordingly to reduce the likelihood of them arising only if managing them proves economically viable.
  • Tolerable Risk. Arise rarely and have little economic impact. These risks and monitored to ensure that they remain at tolerable levels.
  • Severe Risk. Frequent and with a harsh impact on business, these must be managed immediately. The processes in place at Abengoa make it difficult for the company to address this kind of risk.
  • Critical or Emerging Risk. Although these occur rarely, their economic impact can be very harsh. These risks are subject to their own contingency plan, given the severity of their impact. The Corporate Risk Management Department is directly involved in assessing this kind of risk. The following measures are rolled out in an attempt to prevent them:
    • Relating emerging risks with strategic lines of business.
    • Seeking out and analyzing information by assigning resources accordingly.
    • Adapting traditional risk indicators and controls to reflect prevailing market conditions.
    • Addressing signs of “weakness” (no matter how many there are) and investing in technology to control emerging risks.
    • Learning from the management team’s experience and past lessons involving risks.
    • Providing information for risk management strategies through relevant data and proper analysis.