Risk management and control

Although measurement of risk is clearly important, quantification does not always tell the whole story, and not all risks are quantifiable. We therefore pay equal attention to "soft" risks, avoiding the temptation to ignore those that cannot be properly quantified. We also place great emphasis on qualitative controls and rigorous risk control processes to ensure that both quantifiable and unquantifiable risk is identified, assessed and reported.

Stress situations can arise from many sources and when extreme events occur, quantitative and qualitative risk assessments alone are not sufficient. The essential complements are a tried and tested process which can be invoked immediately in response to any crisis, and well-prepared business continuity management processes and plans. We continue to develop and refine these processes as we learn from our own and others' experience.