Risk Management

11 Key excerpts on "Risk Management"

• 

  eBook - ePub

  Risk Assessment

  Theory, Methods, and Applications

  • Marvin Rausand, Stein Haugen(Authors)
  • 2020(Publication Date)
  • Wiley

    (Publisher)

  This definition applies to organizations, but this is because the standard is delimited to Risk Management in organizations. The definition covers all the activities that organizations plan and perform to deal with risk, including what is done to identify and describe risk. Risk assessment is thus a part of Risk Management.

  The US Department of Homeland Security, on the other hand, defines Risk Management as follows:

  Definition 7.2 (Risk Management)

  Risk Management is the process for identifying, analyzing, and communicating risk and accepting, avoiding, or controlling it to an acceptable level considering associated costs and benefits of any actions taken (Homeland Security 2010 ).

  According to ISO 31000, Risk Management should follow these principles:

  • Integrated – should be a part of the overall management, not an activity separated from strategic and operational decisions
  • Structured and comprehensive – systematic and covering everything that is relevant and significant
  • Customized – adapted to and suitable for the organization in question
  • Inclusive – ensure involvement of relevant stakeholders
  • Dynamic – accepts that risk changes and that Risk Management needs to adapt to this
  • Best available information should be used
  • Human and cultural factors need to be taken into account
  • Continual improvement

  The term safety management is often used with the same meaning as Risk Management, but in this chapter we prefer the term “Risk Management.” This is not only in accordance with ISO 31000 but also in accordance with how we use, for example, risk metrics and safety performance metrics, in relation to the future and the past, respectively.

  Another term that is used in relation to management of risk is risk governance (IRGC 2008

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Risk-Based Performance Management

  Integrating Strategy and Risk Management

  • A. Smart, J. Creelman(Authors)
  • 2013(Publication Date)
  • Palgrave Macmillan

    (Publisher)

  7  Managing Risk

  In the context of Risk-Based Performance Management, Risk Management is about understanding and exploiting opportunities and threats (the risk the organization faces in pursuit of its objectives), and the continuous monitoring and management of those risks to ensure the organization executes its strategy while “operating within appetite”.

  Introduction

  The preceding chapter explained the Managing Performance discipline of the Risk-Based Performance Management (RBPM) approach (Figure 7.1 ). This chapter focuses on the Managing Risk discipline. While the previous chapter focused on strategic objectives, this one considers key risks and key controls; while in Managing Performance we looked at Key Performance Indicators (KPIs), here we pay attention to Key Risk Indicators (KRIs) and Key Control Indicators (KCIs). In this chapter we also explain how to assess risk.

  As an introduction, in the context of RBPM we describe Risk Management as being about “understanding and exploiting opportunities and threats (the risk the organization faces in pursuit of its objectives), and the continuous monitoring and management of those risks to ensure the organization executes its strategy while ‘operating within appetite’.” We define risk as: “The uncertainty of future events that will impact on the achievement of objectives, either positively (opportunities) or negatively (threats).”

  But before elaborating on these definitions and describing how they are applied in a practical setting, we provide some historical context for the emergence of Risk Management.

  Figure 7.1  RBPM framework

  The Risk Management discipline and function

  As a discipline and function, Risk Management is a relatively recent addition to an organization’s stable of management tools. It first began to appear within organizations in the 1940s and 1950s with a narrow approach to quantifying and mitigating financial risks (evolving out of earlier work in managing insurable risk). But it wasn’t until the 1960s that the field was actually named, largely through principles and guidelines that were developed by Robert Mehr and Bob Hedges, widely acclaimed as the founding fathers of Risk Management. Mehr and Hedges laid down the following steps for the Risk Management process:

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Quality in the Era of Industry 4.0

  Integrating Tradition and Innovation in the Age of Data and AI

  • Kai Yang(Author)
  • 2023(Publication Date)
  • Wiley

    (Publisher)

  Despite these challenges, ORM is a crucial aspect of Risk Management, particularly for organizations with complex operations or operating in high‐risk industries. It helps organizations to manage the risks that are inherent in their operations and to enhance their operational performance and resilience.

  7.3.2.3 Strategic Risk Management (SRM)

  SRM is a business discipline that focuses on identifying, assessing, and managing the risks that could affect the achievement of an organization's strategic objectives [29 , 30 ]. This could include risks associated with changes in the competitive environment, strategic initiatives, mergers and acquisitions, or changes in customer preferences. SRM provides a structured framework for dealing with the uncertainties that could hinder an organization's ability to execute its strategy.

  Strategic risks can arise from numerous sources such as changes in the business environment, disruptive technology, competitive forces, or from within the organization itself. They can also result from decisions concerning an organization's strategic initiatives such as mergers, acquisitions, partnerships, and entering new markets.

  Key Steps in the SRM Process

  1. Strategic Planning and Risk Identification: This involves understanding the organization's strategic objectives, identifying the potential risks that could affect these objectives, and understanding how these risks might impact the overall strategy.
  2. Risk Assessment: After risks are identified, they are assessed based on their potential impact on the strategic objectives and the likelihood of their occurrence. This helps to prioritize the risks.
  3. Risk Mitigation and Strategy Adjustment:

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Handbook of Systems Engineering and Management

  • Andrew P. Sage, William B. Rouse(Authors)
  • 2011(Publication Date)
  • Wiley-Interscience

    (Publisher)

  Many agree that commensurating high-frequency/low-damage and low-frequency/catastrophic-damage events markedly distort their relative importance and consequences as they are viewed, perceived, assessed, evaluated, and traded off by managers, decision makers, and the public. Some are becoming more and more convinced of the grave limitations of the traditional and commonly used expected-value concept and are complementing and supplementing it with conditional expectation, where decisions about extreme and catastrophic events are not averaged out with more commonly occurring events. 3.2.1 Sources of Failure To be effective and meaningful, Risk Management must be an integral part of the overall management of a system. This is particularly important in technological systems, where the failure of the system can be caused by failure of the hardware, the software, the organization, or the humans involved. The term Risk Management may vary in meaning according to the discipline involved and/or the context. Risk is often defined as a measure of the probability and severity of adverse effects. Risk Management is commonly distinguished from risk assessment, even though some may use the term Risk Management to connote the entire process of risk assessment and management. In risk assessment, the analyst often attempts to answer the following set of three questions: “What can go wrong? What is the likelihood that it will go wrong? What are the consequences? [and What is the time domain?]” (Kaplan and Garrick, 1981). Answers to these questions help risk analysts identify, measure, quantify, and evaluate risks and their consequences and impacts. Risk Management builds on the risk assessment process by seeking answers to a second set of three questions: “What can be done? What options are available, and what are their associated trade-offs in terms of all costs, benefits, and risks? What are the impacts of current management decisions on future options?” (Haimes, 1991, 2004)

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Making Risk Management Work

  Engaging People to Identify, Own and Manage Risk

  • Ruth Murray-Webster, Penny Pullan(Authors)
  • 2022(Publication Date)
  • Routledge

    (Publisher)

  An uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives. Risk is a neutral concept; risks can either be threats (downside risks) or opportunities (upside risks).

  1. Define context and objectives
  2. Identify threats and opportunities
  3. Prioritise risks
  4. Assess combined risk profile
  5. Plan responses
  6. Agree contingency
  7. Monitor and report progress
  8. Review and adapt

  • Entire chapters on risk principles and people considerations
  • Applicable to strategic, portfolio, programme, project, product, and operational risk
  • Part of a larger suite of guidance including Managing Successful Programmes and PRINCE2

  ISO 31000:2018 Risk Management – guidelines (2018) Effect of uncertainty on objectives

  1. Scope, context, and criteria
  2. Risk identification
  3. Risk analysis
  4. Risk evaluation
  5. Risk treatment
  6. Monitoring and review
  7. Recording and reporting
  8. Communication and consultation

  • Applicable to all levels of Risk Management
  • Includes risk principles and a Risk Management framework
  • Lists communication and consultation as distinct element of the process

  PMI Standardfor Risk Management in Portfolios, Programs and Projects (2019) An uncertain event or condition that, if it occurs, has a positive or negative effect on one or more enterprise, portfolio, programme, and project objectives

  1. Plan Risk Management
  2. Identify risks
  3. Perform qualitative risk analysis

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Project Manager's Spotlight on Risk Management

  • Kim Heldman(Author)
  • 2010(Publication Date)
  • Jossey-Bass

    (Publisher)

  As you explore risks and consequences and their impact on the organization through the course of this book, keep in mind that executives sometimes seem to defy logical reason when making decisions. They choose projects that have risks with potentially devastating consequences to the organization while brushing off other projects that to us seem like a no-brainer. So when you’re wondering about why your project wasn’t approved—my advice is don’t. Move on to your next assignment and apply solid project management and Risk Management techniques to help assure its success.

  Purpose of Risk Management

  The good news is risk isn’t the enemy. The bad news is the consequences of ignoring risk can be. What you don’t know can hurt you when it comes to risk. The goal of Risk Management is identifying potential risks, analyzing risks to determine those that have the greatest probability of occurring, identifying the risks that have the greatest impact on the project if they should occur, and defining plans that help mitigate or lessen the risk’s impact or avoid the risks while making the most of opportunity.

  Project management means applying skills, knowledge, and established project management tools and techniques to your projects to produce the best results possible while meeting stakeholder expectations.

  Risk Management means applying skills, knowledge, and Risk Management tools and techniques to your projects to reduce threats to an acceptable level while maximizing opportunities.

  More specifically, Risk Management concerns these five areas:

  • Identifying and documenting risks • Analyzing and prioritizing risks • Performing risk planning • Monitoring risk plans and applying controls • Performing risk audits and reviews

  I’ll describe each of these processes in further detail in their own chapters, so in this section I’ll stick with a high-level definition for each. These processes are highly interactive, and to understand how they all work together, you’ll first look at the purpose for each.

  Identifying and documenting risks

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  The Project Manager's Guide to Handling Risk

  • Alan Webb(Author)
  • 2017(Publication Date)
  • Routledge

    (Publisher)

  The Risk Management Process

  Considerable efforts have been made by individual workers, the professional associations and the standards bodies to devise a general process for managing risks in projects. Although it is unlikely that any international standard for the process of Risk Management will be created in the near future, application guides have been produced that are finding increasing acceptance in industry. Notable among them are the British Standard BS-6079-3:2000 'Project Management - Part 3, Guide to the management of business related project risk'1 , the international standard BS IEC 62198:2001 'Project Risk Management - Application guidelines'2 and the Project Risk Analysis and Management Guide, produced by the UK Association for Project Management.3 The processes advocated are all rather similar and follow the general pattern given in Figure 8.1 .

  Figure 8.1 The generalized Risk Management process.

  Although the process models may differ in detail and the way they are drawn, they all tend to show a series of discrete activities that together form a feedback loop as shown in Figure 8.1 . They tend to agree that the key activities are:

  • identification of the risk issues
  • analysis and assessment of the risks for their potential impact on the project
  • deciding whether anything can or should be done about the identified risks
  • developing responses, where required, to the risk issues; some may be proactive while others may be in the form of a contingency
  • monitoring the situation
  • reassessing the situation in the light of actions taken or risks materializing.

  Notice that the process includes risk assessment as a separate activity that feeds into the Risk Management loop, but the process does not exclude the possibility that risks could materialize even though they have not been assessed or identified in advance. This could occur when the risk-monitoring process detects that the situation has changed but in a way that is unconnected with the assessment process. In practical terms it represents a sudden and unexpected change of project circumstances, for example, a freak environmental disaster such as a flood or earthquake, a catastrophic test failure or a competitor suddenly appearing with a radical new product

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Adaptive Security Management Architecture

  • James S. Tiller(Author)
  • 2010(Publication Date)
  • Auerbach Publications

    (Publisher)

  Risk Management is a very comprehensive system comprising of methods, processes, tools, and, in many cases, dedicated resources tasked with understanding threats, weaknesses, the potential for incidents, and the impact in the event an incident materializes. It uses this information and related analysis to express controls needed to reduce or avoid the risk altogether or simply accept the risk.

  Risk Management, and all that it implies, is essential to a business. In fact, many companies will have a Chief Risk Officer (CRO) or equivalent who is responsible for all risk and usually acts as chairperson for a Risk Management committee comprising executive leadership from all parts of the business. All types of risk information and analysis may be fed into the program to help the company make meaningful, informed decisions. Risk can manifest in a number of ways, including such areas as legal issues, facilities (fire, acts of God, etc.), fiscal performance, investment management, materials management and logistics, equipment, personnel and safety, regulatory, pollution and waste management, unions, and many others. Frankly, the list is infinite and is governed by the structure of the business and industry. Risk is found more commonly in some areas among different industries than others, such as information Risk Management, which is an area of interest for adaptive security management architecture.

  As introduced above, as part of a holistic Risk Management program, information Risk Management can be quite complex. For a far more detailed explanation of information Risk Management I recommend reading anything on this topic by Thomas R. Peltier. Usually, information Risk Management is a combination of several processes. For example, a risk assessment is performed to determine vulnerabilities and the state of controls and that information is overlaid with identified threats. From there, work is done to determine the likelihood of exploitation of vulnerabilities by threat agents and ultimately compare that potential to impact. Other attributes of Risk Management apply as well, such as understanding the valuation of digital assets, influencing policy and standards, articulating controls and their status and capabilities, and performing a comprehensive analysis from which to draw conclusions. Ultimately, information security is as much an art form as it is a science. As a result, there are several standards, approaches, methods, and tools that permeate the security industry. Again, as far as security services management is concerned, it is most interested with the interconnects and its role in service delivery. However, it is necessary to define information Risk Management as it relates to the ASMA in the facilitation of an adaptable security capability.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Risk Management

  Lever for SME Development and Stakeholder Value Creation

  • Céline Bérard, Christine Teyssier, Céline Bérard, Christine Teyssier(Authors)
  • 2017(Publication Date)
  • Wiley-ISTE

    (Publisher)

  Part 2 Risk Management as a Lever for Organizational Development Passage contains an image

  5 Proactive Management of Operating Risks: A Lever to Improve External Funding for SMEs?

  5.1. Introduction

  The modern business environment is characterized by high volatility, resulting in a high level of uncertainty and a multiplicity of risk factors that may compromise the achievement of objectives set by company managers. In such a context, proactive Risk Management in organizations is becoming increasingly important.

  Proactive Risk Management not only facilitates the achievement of the company’s objectives, but also enables it to better respond and adapt to the surprises and disruptions attributable to both its external and internal environment. Therefore, the company should benefit from greater stability in its profits, helping in particular to increase the level of funders’ confidence and facilitating its access to external funding.

  Though not a panacea against any unexpected adverse event, Risk Management makes it possible to avoid several risks or mitigate their effects. It promotes better control over company operations, more optimal allocation of resources and a greater ability to successfully carry out activities with high uncertainty, including some innovation and internationalization activities, and better navigation with “success” in a turbulent environment. This is increasingly expected of SMEs on which is based the economic vitality of many countries [EUR 16].

  Thus, increasing their commitment to innovation, expanding their markets abroad and creating jobs have become the priorities of many SMEs and this leads them to face more and more risks. These activities will require soliciting financing from funders who will have difficulty in accurately measuring the risks involved [ABD 11]. We also recognize, however, that measuring the risks of SMEs is not a simple exercise and, although it is the subject of numerous studies, they still fail to account for the complexity of SMEs and the problems caused by the fact that the risk they present to funders is reduced mainly to a financial dimension.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Primer on Risk Analysis

  Decision Making Under Uncertainty

  • Charles Yoe(Author)
  • 2019(Publication Date)
  • CRC Press

    (Publisher)

  The risk manager’s role in the evaluation and comparison tasks is likely to be limited to deliberation. Risk assessors and others will do the relevant analysis. Making a decision based on the work done in these steps will usually be the risk manager’s responsibility. In some decision contexts, the ultimate decision makers may be elected leaders or other personnel removed from or above the Risk Management process. Even in these instances, however, it is usual for risk managers to make a recommendation based on their experience and intimate knowledge of the problem.

  Adaptive management

  Adaptive management is a Risk Management strategy that is useful when significant uncertainties can be expressed as testable risk hypotheses. Although there are many definitions, it usually consists of a series of steps that include the following:

  • Identify known uncertainties at the time a decision is made.

  • Include experiments that can be used to test hypotheses about the known uncertainties among the design features in the RMO.

  • Measure and monitor the results of the experiments to test the identified hypotheses.

  • Modify predictive models based on what is learned.

  • Use the revised models to identify adjustments to the RMO actions over time to increase the likelihood that management objectives will be attained.

  Adaptive management means that actions are taken to both learn about and at the same time manage the risks of interest. Adaptive Management: The U.S. Department of the Interior Technical Guide is an excellent resource available online (USDOI, 2009).

  Risk Management as described in this chapter is an iterative screening process based on scientific and other criteria. Making a decision, specifically, selecting a recommended RMO, is the final screening activity for a given Risk Management activity. It is in the risk control activities that the risk manager’s job shifts from the normative role of describing the world as it ought to be to taking action, which is the policy dimension of the risk manager’s job.

  It is not unusual for some organizations to rely on default decision rules. For example, some businesses will choose the option with the minimum payback period. Doing nothing is sometimes the default action for an organization, especially one affected by the National Environmental Policy Act (NEPA). It is a safeguard that attempts to ensure that any action taken is preferable to taking no action at all.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Ioannis Tsiouras - The risk management according to the standard ISO 31000

  • Ioannis Tsiouras(Author)
  • 2015(Publication Date)
  • Youcanprint

    (Publisher)

  7.  Risk Management process

  7.1

   General considerations

  The Risk Management process consists of the following stages (fig. 7): 1. Communication and Consultation 2. Establishing the context 3. Risk Assessment:

  1. Risk Identification
  2. Risk Analysis
  3. Risk Evaluation

  4. Risk treatment

  1. Selection of risks treatment options
  2. Identification of Countermeasures to implement
  3. Identification of the existing Countermeasures
  4. Calculating the Residual Risks
  5. Preparing the Risk Treatment Plan

  5. Acceptance of the proposed Residual Risks 6. Implementing the Countermeasures 7. Monitoring and Review.

  The Risk Management process is accomplished through the instances. Each instance is a particular application of the process pattern and should be adapted to the context in which it is to be applied. Each instance should be consistent with the process outlined in the management framework and should be applied in a systematic, effective and efficient manner.

  The first time the Risk Management process is implemented the sequence of activities should be as follows: establishing the context, risk assessment, risk treatment, risk acceptance and implementation of countermeasures. The activities of the Communication and Consultation and the Monitoring and Review should be carried out continuously throughout the risk assessment process.

  Afterward, the activities should continue so that the risks are reassessed and their treatment is reviewed in opportune moments. This is necessary because the knowledge of the context, and also the risks, could be enriched with new information, new insights and new ideas.

  Figure 7 – The Risk Management process

  7.2

   Communication and consultation

  Communication and consultation, as illustrated in the figure 7, is not a step in series into the process of Risk Assessment and Risk Treatment. Communication and consultation should take place continuously throughout the process of Risk Management.

  Sign up to read

  Learn more about book